Valid Autocomplete Tokens In JSX

ID

javascript.jsx_autocomplete_valid

Severity

high

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

JavaScript

Tags

accessibility, jsx, reliability

Description

Reports an autoComplete attribute on a JSX form control whose value is not a token of the HTML autofill vocabulary.

Rationale

The autofill vocabulary is closed. A browser that does not recognise the value treats the field as on and guesses from the surrounding markup, which is the behaviour the author was trying to replace — so a misspelt token does not fail loudly, it silently restores the default. A password manager filling the wrong field, or an address form the browser refuses to complete, is usually this.

<input autoComplete="fullname" />               // FLAW - the token is "name"
<input autoComplete="disabled" />               // FLAW - the value is "off"
<input autoComplete="on name" />                // FLAW - "on" stands alone

<input autoComplete="name" />                   // OK
<input autoComplete="off" />                    // OK
<input autoComplete="shipping postal-code" />   // OK - a modifier and a field name
<input autoComplete="section-work tel" />       // OK - a named autofill section

Every whitespace-separated token has to come from the vocabulary: the field names, the grouping modifiers (shipping, billing, the telephone kinds), the webauthn suffix, or a section- prefixed section name, whose remainder is author-chosen and therefore not checked. Only the controls that support autofill are judged — input, select and textarea.

Remediation

Replace the value with the autofill token for the data the field collects, or write off to opt the field out. Where several groups of the same fields appear in one form, prefix each group with its own section- name so the browser keeps them apart.

© 2026 Xygeni. All rights reserved