password autocomplete

[Russell Beall]

Doesn't that method result in prompting the user to save the password in some browsers even though they can never use it?

Do you also use the autocomplete="off" on the <form> element?

I found that for some browsers, using autocomplete="off" only on the input fields did not prevent the browser from trying to autocomplete the form, but when the attribute was used on the form tag itself, all browsers I tested, IE 8, Firefox, Chrome, Safari, no longer tried to autocomplete the form.

Regards,
Russ.

On Mar 13, 2012, at 10:53 AM, Sharma, Dattathreya wrote:

> We change input field name for each load of the log-in page.
> 
> <input name="ucec30365192a36508b95ea731f02b742"
> id="ucec30365192a36508b95ea731f02b742" type="text" autocomplete="off">
> <input name="p0658945aad71a074863002252ec4b97c"
> id="p0658945aad71a074863002252ec4b97c" type="password" autocomplete="off">
> 
> 
> Datta
> 
> 
> On 3/13/12 9:23 AM, "Russell Beall" <beall at usc.edu> wrote:
> 
>> Thanks Christopher for your reply, and thanks Tom for this useful piece
>> of info which makes this attribute seem more dependable and more like the
>> correct way to achieve this functionality.
>> 
>> Regards,
>> Russ.
>> 
>> On Mar 12, 2012, at 3:54 PM, Tom Scavo wrote:
>> 
>>> On Mon, Mar 12, 2012 at 5:23 PM, Russell Beall <beall at usc.edu> wrote:
>>>> 
>>>> I note that the default login.jsp in the installer does not use the
>>>> form flag, perhaps because it is "nonstandard".  By this I am referring
>>>> to the attribute of the HTML form element: autocomplete="off".
>>> 
>>> FWIW, I'll note that 'autocomplete' is a valid HTML5 attribute:
>>> 
>>> http://www.w3.org/TR/2011/WD-html5-20110525/index.html#attributes-1
>>> 
>>> Tom
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>> 
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net