Prevent Chrome and Chromium to submit username in arbitrary form fields.

[ifokkema]

Describe the bug
The Chrome and Chromium browsers, when configured to remember the LOVD account's username and password, sometimes submit the username in seemingly random form fields. Not only in submissions but also in data views, influencing query results. Because this behavior is often hidden from the user, LOVD seems to behave incorrectly.

To Reproduce
Steps to reproduce the behavior:

1. Using Chrome, having at least a Curator account, configure the browser to remember the account's username and password.
2. From any gene owned by the Curator account, proceed to the full data view.
3. Proceed to do any query.
4. The browser has included the user's username in the Lab-ID field, and no results are likely to be returned.

Expected behavior
Chrome should not mistake LOVD for being one big login form, simply because it has password fields.
To obtain this behavior, hopefully, there is something that LOVD can do to unconfuse Chrome or perhaps, even more, confuse its already confusing behavior, preventing it from inserting the username in functional fields.

Your software (please complete the following information):

• Chrome and Chromium, confirmed on Chrome/89, Chrome/90, Chrome/91.

[leicray]

Just to be clear, this issue is specific to Chrome and Chromium. It does not affect the recent versions of the Microsoft Edge browser that are based on Chromium.

[ifokkema]

Hi Raymond,

I've spent some time on doing some research on this matter. I'll implement the following:

• I'll add a hidden username field everywhere where there's a password field. I'll add the autocomplete attribute with a value of "username" to trigger Chrome to fill in the username there and nowhere else. I hope this helps.
• I'll block auto-filling the password field for some actions, where I really need people to type their passwords.
• I'll continue and add additional autocomplete attributes and labels to other fields to improve the autofill feature. List: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete.

[leicray]

Can you say when Build 28 will be released?

While helping a novice user, I noticed that her ORCID id was being pasted into "Re-site (optional)" field when she saved changes to a variant. I had to advice her to delete the id and its corresponding password from Chrome.

.