New issue
Advanced search Search tips

Issue 894828 link

Starred by 1 user

Issue metadata

Status: Available
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux , Windows , Mac
Pri: 3
Type: Bug

Blocked on:
issue 895411



Sign in to add a comment

Password manager fills in sign-up forms

Project Member Reported by battre@google.com, Oct 12

Issue description

Steps to reproduce:
1. manually save credentials for a site
2a. visit https://www.jcrew.com/r/login/?intcmp=signin_link_globalnav or
2b. visit https://www.dropbox.com/login -> create an account

In both cases the server correctly labels the password field as an account creation password but fills it.
 
Cc: vabr@chromium.org
Labels: OS-Mac OS-Windows
Status: Assigned (was: Unconfirmed)
I've checked both sites:

2a. https://www.jcrew.com/r/login/?intcmp=signin_link_globalnav works for me in Canary and in Stable. The server responses correctly about a new-password field on the sign-up form, the parser understands that this is sign-up form and it's not filled. The problem might be if the server was too slow and the server response was after filling.

2b.This is similar to other issues that we saw. The site manipulates input elements. Here, it works the following way:
  1.On load there is sign-in form with usernane/password which is filled if there are saved credentials.
  2.When the user clicks on register, the site adds first and last name fields to the same page, but password/username fields are already filled (this is the first problem, we don't have mechanism to remove already filled credentials).
 3.NewPasswordFormManager doesn't notice changes in the form, as a result server predictions are ignored (that's the second problem).

The second problem (dynamical changes in the form) is more common and we saw other sites where Password Manager fills by the same reason, example www.aliyun.com.

The first problem is applied only to cases where Password Manager shouldn't fill, eg. sign-up forms. So it's less important. And it's actually more complicated to fix.
Blockedon: 895411
Cc: -vabr@chromium.org dvadym@chromium.org
Labels: -Pri-2 Pri-3
Owner: ----
Status: Available (was: Assigned)
The problem 3 from comment #1 is fixed. And now server predictions are processed correctly. But since we don't have mechanism to undo filled credentials, username/password are left to be filled. 

I think it's not so critical, in the worst case the user needs to remove filled credentials on sign-up form on registration of a new account (which probably is not so often). That's why I'm lowering priority.

Sign in to add a comment