search

elementor / static-html-output

Static HTML Output Plugin for WordPress
https://statichtmloutput.com
The Unlicense
125 stars 35 forks source link

Prevent password-managers tracking deployment credentials fields #98

Closed leonstafford closed 4 years ago

leonstafford commented 4 years ago

initially reported by @thegulshankumar and evidenced as likely affecting many users in https://staticword.press/t/issues-pushing-to-s3-after-24-48-hours/73

Ideally, we shouldn't surface the credentials in the browser at all, but due to the current way we allow for a user to input settings and start an export without first needing to save options/refresh screen, there would need to be bigger task to AJAX post sensitive fields while being input.

Hmm, the latter sounds like a better solution for the long-term, so will leave this issue open to decide on which approach to take short/long term.

thegulshankumar commented 4 years ago

Can we try autocomplete="new-password" to let browser treat as new credential for the specific page?

source: Mozilla

leonstafford commented 4 years ago

Looks perfect, thanks @thegulshankumar!