Browser password manager fills the saved local-login username into the SPA searchbox #625

Closed
opened 2026-09-18 19:37:59 +00:00 by Cordy · 2 comments
Owner

Dogfood find (Nikola, Edge): after saving the local login (admin1) on /login, the browser populates the searchbox in the app with the saved username — which was the original trigger for the #602 stale-filter bug.

Root cause (investigated 2026-09-18):

  1. /login (web/static/login.html) is correctly annotated (autocomplete="username" / current-password), so the credential gets saved for the origin. But the inputs carry no name attributes, so the save is bound only to weak field signals.
  2. On the SPA, the password manager goes hunting for a sign-in form to fill. index.html contains #chpw-cur with autocomplete="current-password" (the change-password dialog — present in the DOM even while closed). Chromium/Edge classifies that as a sign-in password field and then runs its username-predecessor heuristic: pick a preceding fillable text control. The change-password dialog has no username field, so the walk escapes the dialog and lands on the first eligible text control on the page — the searchbox. autocomplete="off" does not help: Chromium's password manager deliberately ignores it for credential fills.

Remediation (this issue):

  • #chpwdlg gains a hidden autocomplete="username" anchor field before #chpw-cur — the recommended change-password pattern; the password manager pairs with it and stops hunting. (Also improves credential-update behaviour on password change.)
  • The searchbox gains name="q" + role="searchbox" — the classifier weighs the q name token heavily as a search field, excluding it from username candidates.
  • login.html (and setup.html) inputs gain name="username" / name="password", strengthening the save-side classification.

Defense in depth: since #602 (v0.6.225), any navigation clears the searchbox anyway, so even a mis-filled value can no longer silently filter listings — this issue removes the mis-fill itself.

Verification is manual by nature (browser heuristics): re-save the credential on /login, reload the app, confirm the searchbox stays empty.

Dogfood find (Nikola, Edge): after saving the local login (`admin1`) on `/login`, the browser populates the **searchbox** in the app with the saved username — which was the original trigger for the #602 stale-filter bug. **Root cause (investigated 2026-09-18):** 1. `/login` (web/static/login.html) is correctly annotated (`autocomplete="username"` / `current-password`), so the credential gets saved for the origin. But the inputs carry **no `name` attributes**, so the save is bound only to weak field signals. 2. On the SPA, the password manager goes hunting for a sign-in form to fill. `index.html` contains `#chpw-cur` with `autocomplete="current-password"` (the change-password dialog — present in the DOM even while closed). Chromium/Edge classifies that as a sign-in password field and then runs its **username-predecessor heuristic**: pick a preceding fillable text control. The change-password dialog has no username field, so the walk escapes the dialog and lands on the first eligible text control on the page — the searchbox. `autocomplete="off"` does not help: Chromium's password manager deliberately ignores it for credential fills. **Remediation (this issue):** - `#chpwdlg` gains a hidden `autocomplete="username"` anchor field before `#chpw-cur` — the recommended change-password pattern; the password manager pairs with it and stops hunting. (Also improves credential-update behaviour on password change.) - The searchbox gains `name="q"` + `role="searchbox"` — the classifier weighs the `q` name token heavily as a search field, excluding it from username candidates. - `login.html` (and `setup.html`) inputs gain `name="username"` / `name="password"`, strengthening the save-side classification. Defense in depth: since #602 (v0.6.225), any navigation clears the searchbox anyway, so even a mis-filled value can no longer silently filter listings — this issue removes the mis-fill itself. Verification is manual by nature (browser heuristics): re-save the credential on /login, reload the app, confirm the searchbox stays empty.
Author
Owner

Shipped in v0.6.226 (PR #626, tag on f52c5a6), live on both dogfoods.

All three remediations from the analysis are in: the hidden autocomplete="username" anchor in the change-password dialog (the actual fix — the manager now pairs inside the dialog instead of hunting to the searchbox), name="q" + role="searchbox" on the searchbox, and name attributes on the login/setup credential inputs.

Needs your manual verification, Nikola (browser heuristics can't be unit-tested): on files-bao in Edge, sign out → sign in as admin1 locally → let Edge re-save the credential → reload the app → the searchbox should stay empty. If Edge still offers/fills the old saved entry, delete the stored credential for the site once and re-save (the old entry was recorded against the weakly-identified fields). Leaving the issue open until your check confirms; close it if clean.

Shipped in **v0.6.226** (PR #626, tag on f52c5a6), live on both dogfoods. All three remediations from the analysis are in: the hidden `autocomplete="username"` anchor in the change-password dialog (the actual fix — the manager now pairs inside the dialog instead of hunting to the searchbox), `name="q"` + `role="searchbox"` on the searchbox, and `name` attributes on the login/setup credential inputs. **Needs your manual verification, Nikola** (browser heuristics can't be unit-tested): on files-bao in Edge, sign out → sign in as `admin1` locally → let Edge re-save the credential → reload the app → the searchbox should stay empty. If Edge still offers/fills the old saved entry, delete the stored credential for the site once and re-save (the old entry was recorded against the weakly-identified fields). Leaving the issue open until your check confirms; close it if clean.
Author
Owner

Verified manually by Nikola in Edge: after re-saving the login credential and reloading, the browser no longer offers the stored username in the searchbox. The v0.6.226 remediation (hidden autocomplete="username" anchor before the password field, searchbox name="q" + role="searchbox", explicit name attributes on login/setup) holds. Closing.

Verified manually by Nikola in Edge: after re-saving the login credential and reloading, the browser no longer offers the stored username in the searchbox. The v0.6.226 remediation (hidden `autocomplete="username"` anchor before the password field, searchbox `name="q"` + `role="searchbox"`, explicit name attributes on login/setup) holds. Closing.
Cordy closed this issue 2026-09-18 21:00:10 +00:00
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#625
No description provided.