Firefox confuses username and e-mail when storing passwords

[Marek Muc]

Hi, I've noticed that Firefox confuses username and e-mail when storing passwords. I.e. when it stores password, it uses e-mail as a username, so it obviously will not work. This does not happen in Chrome. I've tested it in Firefox ver.63.0.3 (64-bit) and this is also true when I register here (on phpBB.com). I checked on Wikipedia and when I tried to register there - Firefox did not confuse these two fields.

Any ideas what is the reason and how to fix it?

[david63]

Any ideas what is the reason and how to fix it?

Turn off auto complete in FireFox

[Marek Muc]

hmm... how do I do that on all devices used by members of my board?

[Mick]

Post an announcement explaining the situation. At the end of it it's a browser problem, not phpBB.

Point them to this How to Disable and Clear AutoFill Info in your Browser

[EA117]

My expectation is that FireFox considers "the field that appears in the tab stop order immediately before the password fields" is presumed to be the username associated with those passwords. Which in the Wikipedia example will be the username. But phpBB is choosing to prompt for the email address after the username, but before the password fields.

You could test the theory by changing the order of these fields. Chrome must be doing something like defaulting to "the first form field in the tab stop order", which would be correct for both the Wikipedia and phpBB field orders.

[david63]

My expectation is that FireFox considers "the field that appears in the tab stop order immediately before the password fields" is presumed to be the username associated with those passwords.

I believe that Firefox autocomplete uses the field name as the key for the data (unless it has changed recently) which means that if you inadvertently enter your password as your username (easily done) then that will be used next time.

Personally I think that in this day and age autocomplete should be removed.

[EA117]

I believe that Firefox autocomplete uses the field name as the key for the data (unless it has changed recently) which means that if you inadvertently enter your password as your username (easily done) then that will be used next time.

I don't think I disagree, but believe that we're talking about two different things. It's explicitly the concept of "saving login credentials" which would be inspecting the relationship between the password fields and what might be designated as the username field. And not the general autocomplete behavior which deals in many other fields besides just "password and username" for the purpose of saving login credentials.

For what it's worth, I tested changing the order of the phpBB registration fields such that the username field is the tab stop before the password fields. You can test the behavior on this site's registration page. Include "phpbb" anywhere in the username you register with a bogus email address, and I'll be happy to delete any incomplete registrations that were created just for testing.

As to what exactly the change was, I happen to be using a proSilver-inheriting style which didn't already attempt to override anything about the registration page template. So in my case I only had to copy /styles/prosilver/template/ucp_register.html into my own style's /template directory, and then edit this ucp_register.html to move the <dl> block containing the email entry field down below the two password entry fields. And then re-ordered the tabindex= values of those four fields to reflect the new on-screen order.

If you're integrating with a non-proSilver-inheriting style, or a style which has already provided a ucp_register.html template, your work will be slightly more in order to perform these same kinds of changes within whatever style and changes you're using.

The completed change, again just based on proSilver 3.2.4, looked as follows:

Code: Select all

	<!-- EVENT ucp_register_credentials_before -->
	<dl>
		<dt><label for="username">{L_USERNAME}{L_COLON}</label><br /><span>{L_USERNAME_EXPLAIN}</span></dt>
		<dd><input type="text" tabindex="1" name="username" id="username" size="25" value="{USERNAME}" class="inputbox autowidth" title="{L_USERNAME}" /></dd>
	</dl>
	<dl>
		<dt><label for="new_password">{L_PASSWORD}{L_COLON}</label><br /><span>{L_PASSWORD_EXPLAIN}</span></dt>
		<dd><input type="password" tabindex="3" name="new_password" id="new_password" size="25" value="{PASSWORD}" class="inputbox autowidth" title="{L_NEW_PASSWORD}" autocomplete="off" /></dd>
	</dl>
	<dl>
		<dt><label for="password_confirm">{L_CONFIRM_PASSWORD}{L_COLON}</label></dt>
		<dd><input type="password" tabindex="4" name="password_confirm" id="password_confirm" size="25" value="{PASSWORD_CONFIRM}" class="inputbox autowidth" title="{L_CONFIRM_PASSWORD}" autocomplete="off" /></dd>
	</dl>
	<dl>
		<dt><label for="email">{L_EMAIL_ADDRESS}{L_COLON}</label></dt>
		<dd><input type="email" tabindex="5" name="email" id="email" size="25" maxlength="100" value="{EMAIL}" class="inputbox autowidth" title="{L_EMAIL_ADDRESS}" autocomplete="off" /></dd>
	</dl>
	<!-- EVENT ucp_register_credentials_after -->

[Marek Muc]

thanks, your solution works! I've just set up an account on your board, but you won't have any problems with telling which one it is

[2600]

I might have to do this. I think a great majority of my users use FF. Well, mostly with their phone. So this might be an issue I'm unaware of. I'll ask my users.

Edit-


Never mind. I can't ask my users. This is for registration. I've applied the fix and looks good. Thanks.

[P_I]

You might not need to, [PHPBB3-15887] Firefox confuses username and e-mail when storing passwords - phpBB Tracker