Cross-browser techniques for disabling password ca

问题:

Saving and auto-filing of username/password is a feature of most modern browsers. And the user can generally choose to disable this feature on a per domain basis. But is there a standard way for the site itself to prevent password caching?

The emphasis here is cross-browser, so I would employ multiple parallel mechanisms if necessary.

(I have seen caching be effectively disabled in the presence of non-standard login fields, eg, an extra hidden password field. But I'd rather not depend on side-effects whose behavior could unexpectedly change in the future.)

Conversely, are there browsers/versions out there that implement password caching without any disable feature?

回答1:

Add autocomplete="off" to your <input> elements. Works in all modern browsers, IIRC.

回答2:

I would imagine that browsers save a form's fields when the form is submitted. What if you used AJAX to get the value of the password field, send it, then clear the field? The form would never actually be submitted, so the browser would, theoretically, never have an opportunity to save the values.

回答3:

Give the password input a randomly generated name that only you can recognize. Store that name, for example, in a hidden field, and then use that to get the inserted password. That way, even if the browser does cache the password, it won't be able to bring it back up next time the user visits.

Your users will likely at this point proceed to cache the passwords on a postit on the side of the monitor, but that's really a whole different battle.

The same method works well against spam, since most bots rely on finding common field names.

回答4:

AFAIK, masked fields (ones that show '*' instead of the symbol you type) are never saved for autocomplete. Do you want to prevent the user from remembering the password to your site in the browser's password-saving facilities?

回答5:

Simply add another password field between the username and password and set the style to display none.

<!-- Username label and text here> ... <--!>
<input type="password" id='txtPasswordDud' style='display: none;' />
<!-- Actual Password label and text here> ... <--!>