Valid Autocomplete Tokens
ID |
html.autocomplete_valid |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Html |
Tags |
accessibility, reliability |
Description
Flags an autocomplete attribute on a form control whose value is not a list of tokens from the
HTML autofill vocabulary.
Rationale
The autofill vocabulary is closed. A browser that does not recognise the value treats the field as
on and guesses the field from the surrounding markup, which is the behaviour the author was trying
to replace — so a misspelt token does not fail loudly, it silently restores the default. A password
manager filling the wrong field, or an address form the browser refuses to complete, is usually this.
<input type="text" name="fullname" autocomplete="fullname"> <!-- FLAW — the token is "name" -->
<input type="text" name="zip" autocomplete="shipping postal-cod"> <!-- FLAW — misspelt field name -->
<input type="tel" name="phone" autocomplete="off tel"> <!-- FLAW — "off" is the whole value or nothing -->
<input type="text" name="name" autocomplete="name"> <!-- OK -->
<input type="text" name="search" autocomplete="off"> <!-- OK -->
<input type="text" name="zip2" autocomplete="shipping postal-code"> <!-- OK — a modifier and a field name -->
<input type="tel" name="phone2" autocomplete="section-work tel"> <!-- OK — a named autofill section -->
<input type="text" name="b" autocomplete="${mode}"> <!-- OK — settled at render time -->Every whitespace-separated token has to come from the vocabulary: the field names, the grouping
modifiers (shipping, billing, the telephone kinds), the webauthn suffix, or a section-
prefixed section name, whose remainder is author-chosen and therefore not checked. on and off
stand alone. The first unknown token is reported.
Only the three controls autofill applies to are judged — input, select and textarea — since
the attribute is inert on anything else. A valueless or empty autocomplete is left alone: it is
HTML’s undefined state for the attribute rather than a wrong value. th:autocomplete and a value
carrying a template expression are settled at render time, and a namespaced element such as
<h:input> is a template component rather than the HTML control it resembles.
Whether a sensitive field should be autofilled at all is a different question with a different fix
(off, rather than a corrected token), and it is reported separately.
Remediation
Replace the value with the autofill field name the control actually collects, prefixing a grouping
modifier when the form has more than one address or telephone number. Write off to opt out of
autofill entirely.
<input type="text" name="fullname" autocomplete="name">
<input type="text" name="zip" autocomplete="shipping postal-code">
<input type="tel" name="phone" autocomplete="tel">