Cordy/Cairn
2
1
Fork 0
Code Issues 20 Pull requests Projects Releases Packages Wiki Activity Actions

#625: keep the password manager out of the searchbox #626

Merged
Cordy merged 8 commits from fix-login-autofill into main 2026-09-18 19:44:21 +00:00
Conversation 0 Commits 8 Files changed 4 +15 -4
Cordy commented 2026-09-18 19:41:03 +00:00
Owner
Copy link

Root cause on the issue: the saved local-login credential gets filled into the SPA because Chromium/Edge pairs the hidden change-password current-password field with the nearest fillable text control — the searchbox (autocomplete="off" is ignored for credential fills by design).

Markup-only hardening:

  • #chpwdlg: hidden autocomplete="username" anchor (#chpw-user) before #chpw-cur — the manager pairs inside the dialog and stops hunting; also the recommended pattern for credential updates on password change.
  • Searchbox: name="q" + role="searchbox" — classified as a search field, excluded from username candidates.
  • login.html / setup.html: name="username" / name="password" on the credential inputs, anchoring the save side.

No JS changes; extract fence + full web suite green. Verification is manual (browser heuristics): re-save the credential on /login, reload the app, searchbox stays empty. Defense in depth: #602's navigation-clear already stops a mis-fill from filtering listings.

Root cause on the issue: the saved local-login credential gets filled into the SPA because Chromium/Edge pairs the hidden change-password `current-password` field with the nearest fillable text control — the searchbox (`autocomplete="off"` is ignored for credential fills by design). Markup-only hardening: - `#chpwdlg`: hidden `autocomplete="username"` anchor (`#chpw-user`) before `#chpw-cur` — the manager pairs inside the dialog and stops hunting; also the recommended pattern for credential updates on password change. - Searchbox: `name="q"` + `role="searchbox"` — classified as a search field, excluded from username candidates. - `login.html` / `setup.html`: `name="username"` / `name="password"` on the credential inputs, anchoring the save side. No JS changes; extract fence + full web suite green. Verification is manual (browser heuristics): re-save the credential on /login, reload the app, searchbox stays empty. Defense in depth: #602's navigation-clear already stops a mis-fill from filtering listings.
changelog: v0.6.226 (#625)
All checks were successful
ci / test-and-build (pull_request) Successful in 1m11s
Details
cbe64fe78d
Cordy merged commit f52c5a6d21 into main 2026-09-18 19:44:21 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#626
No description provided.
Delete branch "fix-login-autofill"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?