ecamp / ecamp3

eCamp v3 is a web-based app for camp and course planning. The application is specialized for camps and courses of youth associations and for Y+S offers in the sport of camp sports/trekking.
https://ecamp3.ch
GNU Affero General Public License v3.0
111 stars 49 forks source link

If the login fields automatically filled out by the google password manager the Login button is not enabled #4406

Open MarcoAllenspach opened 7 months ago

MarcoAllenspach commented 7 months ago

image

Additional: Maybe it could do an automatic login if the filds are filled by a password manager?

carlobeltrame commented 7 months ago

I can reproduce the problem in the latest Chrome, but the button gets activated as soon as I click outside the input fields. So the problem is less critical than it seemed to me when I first read this issue, because tapping on the login button twice will still log you in correctly.

I would vote against auto-submitting the form. For one because it is hard or impossible for our application to detect whether the user was typing individual characters, pasting or using a password manager. One also has to consider users which user other input methods, or don't fill the form top-to-bottom etc. We simply shouldn't make any assumptions about how users do and prefer to fill in their passwords. The auto-submit feature seems to me like it should be done by the password manager, if at all.

Side note: Please be aware that the default behaviour of the google password manager of automatically auto-filling the credentials is considered bad practice and unsecure:

Sweep attacks take advantage of automatic password autofill to steal the credentials for multiple sites at once without the user visiting any of the victim sites. For password managers backed by a syncing service (such as Apple’s iCloud Keychain) the attacker can extract site passwords even if the user never visited the site on that device. These attacks work in password managers that support automatic autofill, highlighting the fundamental danger of this feature.

MarcoAllenspach commented 7 months ago

Yes you are right after the first press on the button the button is enabled

Thank you for the google password manager of automatically auto-filling article :) Did not knwo that