Skip to content

Rename profile password fields so password managers understand

Drew Blessing requested to merge dblessing_password_autocomplete_chrome into master

What does this MR do and why?

Fixes an issue where Chrome (and probably other browsers) and password managers may be confused about which field is the current password field on /-/profile/password/edit and /-/profile/password/new pages/forms.

This is related to a discussion on setting autocomplete HTML value to new-password and current-password, which Firefox respects - #27125 (closed). This MR addresses both Chrome and Firefox.

Screenshots or screen recordings

Before

Notice the current password was autofilled by the browser in 'New password'.

Screen_Shot_2021-09-28_at_10.38.54_AM

After

Screen_Shot_2021-09-28_at_10.37.02_AM

How to set up and validate locally

  1. Sign in as a user
  2. Visit Profile -> Password
  3. Enter current password, new password and confirmation. Submit to change password.
  4. Observe password change is successful.

Observe that your password manager and/or Chrome now correctly see the 'Current password' field as one to fill, while the 'New password' and 'Password confirmation' are seen by password manager as one to generate a new password for.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Drew Blessing

Merge request reports