Hot answers tagged

46

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.


41

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It ...


18

Normally, I recommend replacing fillable PDFs with regular web forms I think overall, yes, that would be the ideal solution, but you noted some of the the issues with this, which includes how to handle all the existing content already made. We run into issues constantly because web browsers love to open PDFs in browser instead of opening the files in the ...


13

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed in the application: function getLastPassVersion() { var lastpass = navigator.plugins['...


12

Why use contact forms? Reduce spam Easier to redirect e-mails to various departments or people Can update the receiving e-mail address without forwards or address book changes Works for users who don't have an e-mail address or e-mail client on their computer Can append website usage stats and other user information to the e-mail No chance for the user to ...


10

You could try to force downloading of the PDF, so that it opens in the default application for viewing PDF files instead of the browser. See this question: How do I force files to open in the browser instead of downloading (PDF)?


9

The Googlebot can submit forms, but it generally doesn't unless it can detect a reason to do so. So from the links, if your translations were AJAX'd and built properly, Googlebot may very well submit the form to see what the results would be. However, this behavior (especially on POST), is not guaranteed and you should probably use GET to make things more ...


6

HTML5 The non-normative section 4.10.1.3 Configuring a form to communicate with a server explicitly says that it is valid: Multiple controls can have the same name; for example, here we give all the checkboxes the same name, and the server distinguishes which checkbox was checked by seeing which values are submitted with that name — like the radio ...


5

On my site I use this type of contact form instead of just showing the email address. The reason is simple: I don't want that the spammers to get my email.


5

All browsers use heuristics for knowing when to save passwords. I'm familiar with Firefox and Chrome. The heuristic they use seems to be: The form must have a password field The text input just before the password field is assumed to be the user name Only those two input fields are saved. Firefox then prompts you that it can remember your changed ...


5

One way to prevent this is to use the POST/Redirect/GET pattern. Instead of directly sending a 200 after receiving the POST request, the server sends a 303 (or 302) redirect instead. The client follows it and gets (via GET) a 200 then. Refreshing this page repeats the last GET, not the previous POST. For implementation questions, see the Stack Overflow tag ...


5

Apart from the obvious security issue of someone else being able to physically see what password you are typing - which the user would be aware of anyway - there are a few security "concerns" that could arise with how it is implemented and what (trustworthy) software is on the users system, that could potentially expose the password to third party apps/tools ...


5

Using the user's email address as the 'from' address in a form notification email is not a good idea because it will trigger many spam filters due to a "spoofed" sender. There are two systems which help detect spoofing: SPF and DKIM. SPF allows the email domain owner to specify which IP addresses and/or domains are valid senders for that domain. If the ...


5

There is no standard practise. You'll have to re-think your process: Why do your customers have to fill out PDFs in the first place? Do you just need structured data from the customer? Who needs the PDF later, a government agency? Do you have to provide the customer with the same PDF? Can your company create web forms instead of PDFs? Can you auto-generate ...


4

There are cases where you could conceivably want to force the user to manually enter data: A domain registrar might apply this to the domain field to ensure accuracy and avoid the auto-filling of previous attempts. If an application might be used in a fairly public setting like a shared kiosk, you might want to prevent a form from giving hints as to who's ...


4

Bing absolutely does. Before I told it not to it would continually submit both a contact form and a survey form. I knew it was Bingbot because I included $_SERVER['HTTP_USER_AGENT'] in the $_POST information. No other spider ever submitted those forms.


4

Yes. Although Google can submit some forms they generally do not do so. So any content that is only available via a form submission should be assumed to be hidden from search engines. Yes. This is functionally the same as an HTML sitemap. You can also submit an XML sitemap (although they don't guarantee crawling).


4

You're on the right track with CURL. What you need to do is add code that reads the website as if it's a basic HTML file then process the file replacing certain HTML code. If some websites are basic with little to no javascript and contain a login box, then look for code containing something like: <input type="text" name="username"> and replace it (...


4

If we are ignoring everything else you mention, (i.e. shared computer, firefox saved passwords, etc.) the "show" password feature is, by itself, not a security risk. It is for convenience and the "everyday user". There is nothing stopping someone from using the build in browser inspector and changing it to an input type textbox from password. It serves the ...


4

There is no inherent security issue with unmasking the password field per-sey. In the functional working of a site any method that can access form fields (such as server side posts or javascript) will still be able to access the data from the masked field without any effort at all. The masking of the password serves two functions. For one it prevents someone ...


4

I don't recommend, but you can bypass this message, by not using the original input text fields. You can create your own input fields, using regular div that have onkeypress event. Or you can create a div element that have the contenteditable attribute set to true. This way, the users will be able to input information on your site, without using input tag ...


4

If you're just serving static files or can put a proxy in front you could use a server like caddy server which handles all of this for you by using lets encrypt, this takes the pain out of provisioning certificates and you don't have to install any other software. Alternatively you could use a service like cloudflare - their free plan offers free https. ...


4

nobody else seems to have mentioned, if you own every machine that connects to your site eg "this is probably not what you want" , like a corporate setting, you can create a certificate authority of your own, install it's public cert into all the machines (well onto all the browsers and cert stores) that connect to your site. this option is free of ...


4

I just tried setting up the default form submission trigger in a client's GMB container and was having the same problem. After a little digging around in Preview mode, I came up with the following solution: Create a second Form Submission trigger and select "Some Forms" under "This trigger fires on". Then set it to fire on submissions where the Click URL ...


3

They can and do. I've got a simple email collection form on the front of a site I'm about ready to launch. I just received a submission from that form from IP 66.249.73.214, which is a GoogleBot IP.


3

The linked article is from 2009. Since then some improvements have been made in regards to form validation. One being that HTML 5 already has built-in form validation, but fails in older browsers with no HTML 5 support. Of course there are javascript libraries which helps you with the validation part like: Parsley.js (Javascript) or jQuery Validation ...


3

Are your visitors going to have a user/account name in addition to their "proper" name? If so, get a username only for trial purposes(or even just use their e-mail address) and only ask for full profile information once they decide they want to actually move to a paid plan. This is less invasive all around(since they may not even come back), and doesn't ...


3

By far my favorite technique is called a 'honeypot'. Here is how it works... Say your form asks for a name. Put the following two fields on the page: <span class='hp'> <label for='Message'>Message:</label > <textarea id='Message' name='message' /> </span> <span> <label for='TmpField'>Message:</label > ...


3

Your request body is very large. If I'm correct, your request body is at least 10.4 KB in size because of all those fields that begin with chk and that have a value of at least 5 characters. That makes 10 characters (including equals and a one-digit chk number). Multiply 10 by 1024 fields crafted this way and you get 10.2 KB request size minimum. Ask ...


3

Most of these password managers are browser plugin based and work by populating the form fields and triggering a form submission as if the ueer pressed the submit button, to the server it appears as a normal form submission, no way to tell if it coming from a password manager.


Only top voted, non community-wiki answers of a minimum length are eligible