Preventing Password Autofill

Public Autofill prevention for your site

[artienet]

Hi forum,

I know this topic has been addressed and with good reply.

I just wanted to add another method of preventing browser autofill for your password protected website etc..

Using javascript, you can also create a small loop that will increment upon keyUp or KeyDown.. This will insure that the user actually types within the password field.

If the loop variable has not incremented to your predefined value, you then have the getElementById clear the field upon each submit (Optional).

Anyhow I hope this helps, and if you need more detail on this issue feel free to let me know.. Thanks.

[Shores]

There's a simple server side way of making impossible browser's autofill: simply, always use randomly generated input box names, such as username_jdgfhkjhgfkkgfhgfhsd and password_kgfhdacvbSDGHKH, and then pick up username and password from the fields that only begin with username_ and password_ ...

This also method doesn't rely on javascript at all, so works even if js is disabled!

[artienet]

Hi Shores,

Yeah, that sounds quite cool also, especially eliminating js. however, I do believe around 90+ % users now days likely have js enabled..

I came across my idea by having the need to have a dynamic password check without refreshing or leaving the page so the user could resume there original activity. that's kind of how the js got involved..

normally I just do the old php page script thing, but for this instance, I wanted the user not to lose focus of what they were doing after entering their password. A little time interval security check to prevent unregistered public from accessing an unclosed member page.

Anyhow, that's a great Idea, thanks for the input..