Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

What properties login form needs to have to trigger "remember password" for all (or most) browsers?

Background: For years I have been using Opera, and the rule has been that almost anything that looks like login form triggers this feature. Now I'm exploring other browsers, and surprisingly find that one of login forms I visit most often, Roundcube login page, does not trigger this feature neither in Chromium nor Firefox (tried various versions and page setups of RC).

Since it's on my VPS, I could patch it up and eventually even send that to RC development team, but I have the unnerving feeling that this must have been solved over and over, and it's just me being blind or something.

Update: My original problem has been solved. The reason why it did not work was autocomplete=off property on relevant input fields, which is governed by RC settings and ignored by cranky Opera. (It does not provide answer to my, somehow more generic question, though.)


So again: is there any consensus between browser developer as to when this feature should be triggered? Is there a best practice for webmasters to tell the browser "this is the login page"? Or are all browsers using their own heuristics?

share|improve this question
    
Talking from memory, but I believe I tend to see the popup in most browsers (ex. Chrome, Firefox) after loading a new page from a form post with an input of type password, but maybe not after an ajax login. It also does not show if you have (recently?) told it what you want to do on that site already, but clearing browser data may reset that. –  joshuahedlund Oct 28 '13 at 20:42
    
That would explain when to trigger, but would not explain when to offer re-inserting it, unless the browser would save the "last page", which seems little bit fragile (since the page might change as well as its URL). Also I've tried it with new profiles, I don't think refusing it in the past is the problem. –  Alois Mahdal Oct 28 '13 at 23:24

2 Answers 2

All browsers use heuristics for knowing when to save passwords. I'm familiar with Firefox and Chrome. The heuristic they use seems to be:

  • The form must have a password field
  • The text input just before the password field is assumed to be the user name
  • Only those two input fields are saved.

Firefox then prompts you that it can remember your changed password when you fill out a form with two password fields.

Here is a list of things that I typically see break these algorithms:

  • Sites that use autocomplete=off (specifically requesting that browsers not remember passwords)
  • Separating login into multiple pages where the user name is entered on one page and the password is entered on the next.
  • Using Javascript to copy the contents of these fields into hidden fields in a hidden form and then submitting the hidden form rather than the visible form
  • Requiring more than two fields to be filled out such as
    • User name, SSN, and password
    • User name, password, and PIN
  • Changing the names of the username and password fields periodically (causes firefox to no longer be able to fill in the password, even when it is remembered).

Some of these items are done by webmasters purposefully to defeat password saving.

share|improve this answer

Just make sure your password HTML element is marked with input type='password' and browser will handle the rest.

share|improve this answer
    
I thought about that, but how does browser know which one is the user name? Or does it save all other inputs? (BTW I'm not the downvoter FTM...) –  Alois Mahdal Oct 28 '13 at 23:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.