Chrome password auto-fill breaking IPv6

JeGr · May 28, 2019, 12:07 PM

@johnpoz said in Chrome password auto-fill breaking IPv6:

Do you think there is some code pfsense could put on its forms to tell chrome not to fill them?

Actually there is. You can set autocomplete="xy" on a form field to signal browsers to stop form-filling or how they should handle them. BUT it also states clearly, that id/names of those fields should be pretty specific to trigger that. The field in question is "dhcprejectfrom" and I can't see how in the hell that should be a trigger to inject a "name" field in it. So either Chrome reads the form name and that triggers it or it's completely bonkers.

My 2c would be to actually stop password-filling/-saving in/from any browser and use a password safe (like keepass) and if you're lazy an extension for your favourite browser to have it fill your login forms after asking. Most extension that does so (lastpass for their service, kee/vault for keepass, etc.) have a much better matching algorithm or configuration on which sites they offer and on which the don't allow to fill in. I'm using a combo of auto-type or "kee" (extension) with keepass for years. Best thing ever. And inter-operable if you ever switch browsers for testing etc.

Derelict · May 28, 2019, 5:45 PM

I gave up on all of that browser plugin junk a couple years ago and now use the Lastpass mac application and copy/paste everything. They have made it pretty easy, I think in part due to my feedback. :)

This has the added benefit of being the same workflow for everything - even if it is not in the browser (or is in a secondary browser for testing reasons, etc).

stephenw10 · Jun 3, 2019, 12:08 PM

If it's auto-filling a value in that field that value is stored somewhere and you should be able to remove it from Chrome.

I use Chromium all the time and have never hit that issue. The proxy pass/username auto-fill is very annoying though.

Steve

tcarlisle · Feb 19, 2020, 4:18 PM

Wow, the temperature in here sure is hot. Yeah, the OP did not in any way blame pfsense and did not demonstrate an expectation that pfsense would own resolving this.

Anyone that has researched this has found that getting google to consider changing the autofill behavior so it can be disabled on a per-site basis knows that is not going to happen any time soon.

That said, I was able to solve the problem I was seeing by going to my google account and removing saved login/password for the firewall. As long as I have it set to save credentials in google, then certain pages also populate my username on forms. For example, when viewing the admin page for an interface, in the "reject leases from" box., it would always put my login that was saved from the login page.

It probably isn't a particularly good practice to have your firewall credentials saved in a browser anyways.

I spent a little time looking at the page html and I can see no good reason why google chrome would mistake this field for the user's login. So this is clearly a chrome issue.

Raffi_ · Feb 19, 2020, 5:23 PM

Agree with @bimmerdriver and @tcarlisle on this. The op did a service of letting others know about the issue and never actually requested a fix or placed blame on pfSense. Yes, the forum is mostly people trying to get a fix or requesting help, but it's not exclusively for those purposes. I often just browse random topics like this to learn from others.

Thanks for the heads up.

Raffi

stephenw10 · Feb 19, 2020, 5:26 PM

Technically this should have been in general discussion if it was known not to be a pfSense issue initially.
I've moved it there now.

I've been bitten by this sort of thing and blamed pfSense in the past. It was the LastPass plugin in my case.

Steve

Nelso5n · Mar 3, 2020, 10:26 AM

This is breaking the system that the web page is being used for. The only work-around I could find was to delete the username and password.

jimp · Mar 3, 2020, 6:29 PM

Might be better on 2.4.5 & 2.5.0: https://redmine.pfsense.org/issues/9864

Gertjan · Apr 24, 2020, 6:10 AM

@andrealucia said in Chrome password auto-fill breaking IPv6:

This prevents the IPv6 gateway from starting. In years of running pfsense, I've never seen this behaviour.

When pfSense boots, interfaces are mounted, protocols are started, things like IPv4 and IPv6 are activated, links are build. IP's are set, masks and gateways are defined.
All this happens long before processes like a web server (nginx), that hosts the pfSense GUI, are started.

Yet the login of a user using some browser disrupts the IPv6 gateway ?
How ?

@andrealucia said in Chrome password auto-fill breaking IPv6:

Is there any other work-around?

I thought the issue was solved. It's a browser behaviour.

Slat1e · Apr 25, 2020, 12:28 PM

This post is deleted!