contao/import — Issue #3019: Password fields should disable autocomplete
Author: fbender
Created: 2011-11-29 20:43:09+00:00
State: open
Labels: backend, Feature

As HTML5 is now officially supported in Contao, I'd like to see password input fields disabling [autocomplete](http://www.whatwg.org/specs/web-apps/current-work/multipage/common-input-element-attributes.html#attr-input-autocomplete) in the backend / DCA by default, and maybe some frontend password input fields (most notably the password reset field in the "personal data" module). You should also be able to set the autocomplete attribute via DCA.

Why?
* First of all, there is one major issue when letting your browser save your credentials for the backend login (which is not advised but cannot be forbidden): When you e. g. edit members/users, the password field can be pre-filled with the editor's password, triggering an error when you try to save it (due to the empty password check field). This could apply to every "password" field e. g. used in extensions.
* Plus, we could teach users a lesson on how to handle login credentials (i. e. you shouldn't save them) if we disable autocomplete on the backend login page (not the frontend, though, as this impacts usability).
* Apart from this, logically, backend form fields shouldn't be pre-filled by the user agent. The data entered here is simply not personal data (except maybe the user's personal data page). So backend forms should use the [autocomplete attribute for forms](http://www.whatwg.org/specs/web-apps/current-work/multipage/forms.html#attr-form-autocomplete.)

What about backwards compatibility / XHTML1 mode? No problem! Though autocomplete is only standardized in HTML5, the attribute has been honoured by most user agents for months and years. All other verions of user agents simply ignore the attribute. It won't validate in non-HTML5 but it won't trigger any error.

Related issues: #2835, #2902

--- _Originally created on April 19th, 2011, at 03:58pm (ID 3019)_