Hot answers tagged

47

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.


41

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It ...


33

At its root, this is a problem about verifying ownership of an email address, and as far as I know there are only two ways to practically verify ownership of an email address: Send a verification email, as you mentioned. Complete an authentication flow with the email provider, OAuth-style. Option 2 works great if your user has an email provider that ...


18

Normally, I recommend replacing fillable PDFs with regular web forms I think overall, yes, that would be the ideal solution, but you noted some of the the issues with this, which includes how to handle all the existing content already made. We run into issues constantly because web browsers love to open PDFs in browser instead of opening the files in the ...


13

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed in the application: function getLastPassVersion() { var lastpass = navigator.plugins['...


10

You could try to force downloading of the PDF, so that it opens in the default application for viewing PDF files instead of the browser. See this question: How do I force files to open in the browser instead of downloading (PDF)?


9

The Googlebot can submit forms, but it generally doesn't unless it can detect a reason to do so. So from the links, if your translations were AJAX'd and built properly, Googlebot may very well submit the form to see what the results would be. However, this behavior (especially on POST), is not guaranteed and you should probably use GET to make things more ...


8

There is not much you can do to avoid verification mails (in case you actually need to store and verify mails at all, of course): if you display it to users or sent mails to that address, you better make sure the owner has consented. Besides verifying the email, it also somewhat is used to verify idendity (when more intrusive methods like Government eID, ...


6

HTML5 The non-normative section 4.10.1.3 Configuring a form to communicate with a server explicitly says that it is valid: Multiple controls can have the same name; for example, here we give all the checkboxes the same name, and the server distinguishes which checkbox was checked by seeing which values are submitted with that name — like the radio ...


6

All browsers use heuristics for knowing when to save passwords. I'm familiar with Firefox and Chrome. The heuristic they use seems to be: The form must have a password field The text input just before the password field is assumed to be the user name Only those two input fields are saved. Firefox then prompts you that it can remember your changed ...


6

One way to prevent this is to use the POST/Redirect/GET pattern. Instead of directly sending a 200 after receiving the POST request, the server sends a 303 (or 302) redirect instead. The client follows it and gets (via GET) a 200 then. Refreshing this page repeats the last GET, not the previous POST. For implementation questions, see the Stack Overflow tag ...


6

Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that could arise with how it is implemented and what (trustworthy) software is on the users system, that could potentially expose the password to third party apps/tools ...


5

Using the user's email address as the 'from' address in a form notification email is not a good idea because it will trigger many spam filters due to a "spoofed" sender. There are two systems which help detect spoofing: SPF and DKIM. SPF allows the email domain owner to specify which IP addresses and/or domains are valid senders for that domain. If the ...


5

There is no standard practise. You'll have to re-think your process: Why do your customers have to fill out PDFs in the first place? Do you just need structured data from the customer? Who needs the PDF later, a government agency? Do you have to provide the customer with the same PDF? Can your company create web forms instead of PDFs? Can you auto-generate ...


4

Bing absolutely does. Before I told it not to it would continually submit both a contact form and a survey form. I knew it was Bingbot because I included $_SERVER['HTTP_USER_AGENT'] in the $_POST information. No other spider ever submitted those forms.


4

Yes. Although Google can submit some forms they generally do not do so. So any content that is only available via a form submission should be assumed to be hidden from search engines. Yes. This is functionally the same as an HTML sitemap. You can also submit an XML sitemap (although they don't guarantee crawling).


4

You're on the right track with CURL. What you need to do is add code that reads the website as if it's a basic HTML file then process the file replacing certain HTML code. If some websites are basic with little to no javascript and contain a login box, then look for code containing something like: <input type="text" name="username"> and replace it (...


4

Your request body is very large. If I'm correct, your request body is at least 10.4 KB in size because of all those fields that begin with chk and that have a value of at least 5 characters. That makes 10 characters (including equals and a one-digit chk number). Multiply 10 by 1024 fields crafted this way and you get 10.2 KB request size minimum. Ask ...


4

If we are ignoring everything else you mention, (i.e. shared computer, firefox saved passwords, etc.) the "show" password feature is, by itself, not a security risk. It is for convenience and the "everyday user". There is nothing stopping someone from using the build in browser inspector and changing it to an input type textbox from password. It serves the ...


4

There is no inherent security issue with unmasking the password field per-sey. In the functional working of a site any method that can access form fields (such as server side posts or javascript) will still be able to access the data from the masked field without any effort at all. The masking of the password serves two functions. For one it prevents someone ...


4

I don't recommend, but you can bypass this message, by not using the original input text fields. You can create your own input fields, using regular div that have onkeypress event. Or you can create a div element that have the contenteditable attribute set to true. This way, the users will be able to input information on your site, without using input tag ...


4

If you're just serving static files or can put a proxy in front you could use a server like caddy server which handles all of this for you by using lets encrypt, this takes the pain out of provisioning certificates and you don't have to install any other software. Alternatively you could use a service like cloudflare - their free plan offers free https. ...


4

nobody else seems to have mentioned, if you own every machine that connects to your site eg "this is probably not what you want" , like a corporate setting, you can create a certificate authority of your own, install it's public cert into all the machines (well onto all the browsers and cert stores) that connect to your site. this option is free of ...


4

I just tried setting up the default form submission trigger in a client's GMB container and was having the same problem. After a little digging around in Preview mode, I came up with the following solution: Create a second Form Submission trigger and select "Some Forms" under "This trigger fires on". Then set it to fire on submissions where the Click URL ...


3

By far my favorite technique is called a 'honeypot'. Here is how it works... Say your form asks for a name. Put the following two fields on the page: <span class='hp'> <label for='Message'>Message:</label > <textarea id='Message' name='message' /> </span> <span> <label for='TmpField'>Message:</label > ...


3

They can and do. I've got a simple email collection form on the front of a site I'm about ready to launch. I just received a submission from that form from IP 66.249.73.214, which is a GoogleBot IP.


3

The linked article is from 2009. Since then some improvements have been made in regards to form validation. One being that HTML 5 already has built-in form validation, but fails in older browsers with no HTML 5 support. Of course there are javascript libraries which helps you with the validation part like: Parsley.js (Javascript) or jQuery Validation ...


3

Most of these password managers are browser plugin based and work by populating the form fields and triggering a form submission as if the ueer pressed the submit button, to the server it appears as a normal form submission, no way to tell if it coming from a password manager.


3

This is a common problem when sending mail from a site on a shared hosting account that has its mail hosted offsite. What your host needs to do is disable local mail delivery for your domain name. Depending on what control panel they offer you, you may even be able to do this yourself. For example, in cPanel (which you might have access to at http://example....


3

You could make use of the ContactPoint type to represent the support chat. For the contactType property, Schema.org doesn’t define any values. Google, for their Corporate Contacts feature, recognizes a few strings, but their feature seems to be for telephone numbers, not chat. Among those values, the following might apply in your case: customer support ...


Only top voted, non community-wiki answers of a minimum length are eligible