javascript 防止 Chrome 提示从输入框中保存密码？

Prevent Chrome from prompting to save password from input box?

提问by Jordan H

Chrome was recently updated with an annoying popup that comes down from an icon in the address bar and prompts to save a password on the page when the user submits the form. There's no other input box on this page, and no other browser prompts to save this password, so I don't know why Chrome does. It is a password, therefore it shouldn't be visible as plain text in the input box, but it's not a password that should ever be saved - it's not login credentials. It's actually quite important the user of the computer does not know this password - someone else must enter it in for them - so if the browser saves it that would be bad.

Chrome 最近更新了一个恼人的弹出窗口，该弹出窗口从地址栏中的一个图标出现，并在用户提交表单时提示在页面上保存密码。这个页面没有其他输入框，也没有其他浏览器提示保存这个密码，所以不知道Chrome为什么会这样。这是一个密码，因此它不应该在输入框中以纯文本形式显示，但它不是应该保存的密码 - 它不是登录凭据。计算机的用户不知道这个密码实际上非常重要 - 其他人必须为他们输入 - 所以如果浏览器保存它会很糟糕。

How can you prevent Chrome (and all browsers) from prompting to save this password?

如何防止 Chrome（和所有浏览器）提示保存此密码？

<form action="/..." method="post" onsubmit="return pwFormIsSubmittable();">
    <p>Password: <input autofocus="" type="password" name="1409_password" style="width:100px" tabindex="1" autocomplete="off"></p>
    <div class="tabSubmitButtons">
        <input type="button" name="event=default" value="Cancel" onclick="window.location='...'" tabindex="3">");
        <input type="submit" value="Submit" onclick="submitForm();" tabindex="2">
        <input type="hidden" name="begin" value="Yes">
        <!-- couple other hidden inputs -->
    </div>
</form>

采纳答案by Jordan H

One solution or workaround is to add <input type="password" style="display:none"/>above the real password input box. Chrome only tries to save the first password it finds and if it's blank it won't throw up the dialog to save it.

一种解决方案或变通方法是<input type="password" style="display:none"/>在真实密码输入框上方添加。Chrome 只会尝试保存它找到的第一个密码，如果它是空白的，它就不会弹出对话框来保存它。

回答by Ian Boyd

The reason browsers are ignoring autocomplete=offis because there have been some web-sites that tried to disable auto-completing of passwords.

浏览器忽略的原因autocomplete=off是因为有一些网站试图禁用自动完成密码。

That is wrong; and in July 2014 Firefox was the last major browser to finally implement the change to ignore any web-site that tries to turn off autocompleting of passwords.

那是错的; 2014 年 7 月，Firefox 是最后一个最终实施更改以忽略任何试图关闭自动完成密码的网站的主要浏览器。

• Bugzilla Bug 956906 - ignore autocomplete="off" when offering to save passwords via the password manager(archive.is)
• Reddit discussion(archive.is)
• Chrome's announcement when they began ignoring autocomplete=off(archive.is)
• IE11 fixed the bug of not being able to auto-complete passwords(archive.is)

• Bugzilla 错误 956906 - 在通过密码管理器( archive.is)提供保存密码时忽略 autocomplete="off"
• Reddit 讨论（archive.is）
• Chrome 开始忽略时的公告autocomplete=off( archive.is)
• IE11 修复了无法自动补全密码的问题( archive.is)

Any attempt by any web-site to circumvent the browser's preference is wrong, that is why browsers ignore it. There is no reason known why a web-site should try to disable saving of passwords.

任何网站试图绕过浏览器的偏好都是错误的，这就是浏览器忽略它的原因。没有理由知道为什么网站应该尝试禁用密码保存。

• Chrome ignores it
• Safari ignores it
• IE ignores it
• Edge ignores it
• Firefox ignores it

• Chrome 忽略它
• Safari 忽略它
• IE 忽略它
• 边缘忽略它
• Firefox 忽略它

Microsoft even had to explain before IE11 that it wasn't a bug in the browser - that the web-site was broken: Why Won't IE Remember My Login Info?(archive.is)

微软甚至不得不在 IE11 之前解释说这不是浏览器中的错误——网站被破坏了：为什么 IE 不会记住我的登录信息？（存档。是）

What if I'm a special snowflake?

如果我是特殊的雪花怎么办？

There are people who bring up a good use-case:

有些人提出了一个很好的用例：

I have a shared, public area, kiosk style computer. We don't want someone to (accidentally or intentionally) save their password so they next user could use it.

我有一台共享的公共区域信息亭式计算机。我们不希望有人（无意或有意）保存他们的密码，以便他们的下一个用户可以使用它。

That does not violate the statement:

这并不违反声明：

Any attempt by any web-site to circumvent the browser's preference is wrong

任何网站试图绕过浏览器的偏好都是错误的

That is because in the case of a shared kiosk:

这是因为在共享信息亭的情况下：

• it is not the web-serverthat has the oddball policy
• it is the client user-agentthat has the oddball policy

• 它不是具有奇怪政策的网络服务器
• 它是具有奇怪策略的客户端用户代理

The browser(the shared computer) is the one that has the requirement that itnot try to save passwords.

该浏览器（在共享计算机）是有要求的一个也没有尝试保存密码。

The correct way to prevent the browserfrom saving passwords
is to configure the browserto not save passwords.

防止正确的方法浏览器从保存密码
是在配置浏览器不保存密码。

Since you have locked down and control this kiosk computer: you control the settings. That includes the option of saving passwords.

由于您已锁定并控制此自助服务终端计算机：您可以控制设置。这包括保存密码的选项。

In Chrome and Internet Explorer, you configure those options using Group Policies (e.g. registry keys).

在 Chrome 和 Internet Explorer 中，您可以使用组策略（例如注册表项）配置这些选项。

From the Chrome Policy List:

从Chrome 政策列表：

AutoFillEnabled

Enable AutoFill

Data type:Boolean (REG_DWORD)

Windows registry location:Software\Policies\Chromium\AutoFillEnabled

Description:Enables Chromium's AutoFill feature and allows users to auto complete web forms using previously stored information such as address or credit card information. If you disable this setting, AutoFill will be inaccessible to users. If you enable this setting or do not set a value, AutoFill will remain under the control of the user. This will allow them to configure AutoFill profiles and to switch AutoFill on or off at their own discretion.

自动填充已启用

启用自动填充

数据类型：布尔型 (REG_DWORD)

Windows 注册表位置：Software\Policies\Chromium\AutoFillEnabled

说明：启用 Chromium 的自动填充功能，并允许用户使用以前存储的信息（例如地址或信用卡信息）自动完成 Web 表单。如果禁用此设置，用户将无法访问自动填充。如果您启用此设置或不设置值，自动填充将保持在用户的控制之下。这将允许他们配置自动填充配置文件并自行决定打开或关闭自动填充。

Please pass the word up to corporate managers that trying to disable autocompleting of password is wrong. It is so wrong that browsers are intentionally ignoring anyone who tries to do it. Those people should stop doing the wrong thing.?

请告知公司经理，试图禁用密码自动完成功能是错误的。浏览器故意忽略任何尝试这样做的人是错误的。那些人应该停止做错事。？

---

---

We need to prevent governments, corporate polcies, security auditors, PCI, HIPPA from trying to prevent users from saving passwords. There is no valid use case to prevent a user from saving their credentials.

我们需要阻止政府、公司政策、安全审计师、PCI、HIPPA 试图阻止用户保存密码。没有有效的用例来阻止用户保存他们的凭据。

• If you have a password reset screen: the password should be entered in an unmasked plaintext box
• If you want a 2FA password: the password should be entered in an unmasked plaintext box
• If you have a one-time password: the password should be entered in an unmasked plaintext box

• 如果您有密码重置屏幕：应在未屏蔽的纯文本框中输入密码
• 如果你想要一个 2FA 密码：密码应该在一个未屏蔽的明文框中输入
• 如果您有一次性密码：应在未屏蔽的明文框中输入密码

Alternatively, you can suggest an alternative that allows a web-site to prevent saving of passwords - as long as it does not prevent the user from saving any passwords.

或者，您可以建议一种替代方法，允许网站阻止保存密码——只要它不阻止用户保存任何密码。

Put it another way

换一种方式

In other words:

换句话说：

• if the usersbrowser
• mistakes "Please enter the name of your favorite maiden name's first color."for a new password
• and the user
• doesn't want theirbrowser
• to update theirpassword,
• then they
• will click Nope

• 如果用户浏览器
• 错误“请输入您最喜欢的娘家姓的第一个颜色的名字。” 新密码
• 和用户
• 不想要他们的浏览器
• 更新他们的密码，
• 然后他们
• 将单击否

It's not your job to over-rule the user's wishes. It's their browser; not yours.

否决用户的意愿不是你的工作。这是他们的浏览器；不是你的。

回答by Martin

Instead of using input type password, use type textwith style set to style="-webkit-text-security: disc;"which will replace the characters with dots.

不要使用输入类型password，而是使用样式设置为style="-webkit-text-security: disc;" 的类型文本 这将用点替换字符。

<input type="text" id="password" style="-webkit-text-security: disc;">

There are other options to using the dot:

还有其他使用点的选项：

input { -webkit-text-security: none; }
input { -webkit-text-security: circle; }
input { -webkit-text-security: square; }
input { -webkit-text-security: disc; /* Default */ }

Answer found here: how to disable save password prompt in chrome

答案在这里找到：如何在 chrome 中禁用保存密码提示

回答by Mukesh

You can change the type of the password field to text before submitting the form:  

您可以在提交表单之前将密码字段的类型更改为文本：  

<script type="text/javascript">
    function validate() {
    return true;

}

function copyPass() {
    document.getElementById("hidPassword").value = document.getElementById("passwordField").value;
 if (document.getElementById("passwordField").value != "") {
        var passwordLength = document.getElementById("passwordField").value.length;
       document.getElementById("passwordField").value =  "?".repeat(passwordLength);
    }
    document.getElementById("passwordField").type = 'text';
}

function changeType() {
    document.getElementById("passwordField").type = 'password';
 document.getElementById("passwordField").value = document.getElementById("hidPassword").value;
}
</script>
<form method="post" action="yoururl" runat="server">

      <input type="text" name="username" />
      <input type="password" id="passwordField" name="passwordField" onfocus="javascript:changeType()" onblur="javascript: copyPass()" />
          <input type="hidden" name="hidPassword" id="hidPassword" value="" />
      <input type="submit" runat="server" name="btnsubmit" value="Submit" onclick="javascript:return validate()" />

    </form>

回答by Mazzy

It seems in the later versions of Chrome, they have decided to ignore autocomplete="off" for passwords... See:

似乎在更高版本的 Chrome 中，他们决定忽略密码的 autocomplete="off" ......参见：

https://groups.google.com/a/chromium.org/forum/#!msg/chromium-dev/zhhj7hCip5c/PxbtDtGbkV0J

https://groups.google.com/a/chromium.org/forum/#!msg/chromium-dev/zhhj7hCip5c/PxbtDtGbkV0J

Here's another person answering this question with a hacky solution you might be able to try, if it's a project requirement:

这是另一个人用你可以尝试的hacky解决方案回答这个问题，如果这是一个项目要求：

Chrome Browser Ignoring AutoComplete=Off

Chrome 浏览器忽略 AutoComplete=Off

回答by Prasanna Jathan

I fixed with the following markup

我修复了以下标记

#txtPassword {
  -webkit-text-security: disc;
}

<form autocomplete="off">
  <input type="text" name="id" autocomplete="off"/>
  <input type="password" id="prevent_autofill" autocomplete="off" style="display:none" tabindex="-1" />
  <input type="password" name="password" id="txtPassword" autocomplete="off"/>
  <button type="submit" class="login100-form-btn">Login</button>
</form>

回答by Kyan

I found a way to make Chrome ignore password/username combination even they all in that name.

我找到了一种让 Chrome 忽略密码/用户名组合的方法，即使它们都使用该名称。

<input name='username' type='text'>
<input name='password' type='password' 
       onblur='this.type="password"'
       onfocus='this.type="text"'>

The keypoint is to set onblurand onfocuswith type change.

关键点是设置onblur和onfocus类型更改。

You can do it also by:

你也可以这样做：

$('input[name="password"]').blur(function(){
    $(this).attr('type', 'password')
})
$('input[name="password"]').focus(function(){
    $(this).attr('type', 'text')
})

Don't know why. I guess it's a bug.

不知道为什么。我想这是一个错误。