The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Problem/Motivation
When an admin is adding a new user to the website, the browser will often try to autocomplete the password according to the admin's password.
Proposed resolution
Use automcomplete="new-password" in the password field, in order to disable autocomplete and most modern browsers will actually suggest generating a new password.
This is an upcoming feature in Chrome and Firefox:
https://www.caniuse.com/#feat=mdn-html_global_attributes_autocomplete_ne...
(IE11 does not support it, but this wouldn't degrade the existing user experience)
To read more about this feature:
https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site...
Remaining tasks
User interface changes
API changes
Data model changes
Release notes snippet
| Comment | File | Size | Author |
|---|---|---|---|
| #2 | core-prevent-autofilling-passwords-for-new-users-2.patch | 1.44 KB | shaal |
Comments
Comment #2
shaalComment #3
joumHi shaal!
Tested it against 8.7.8 and it looks good. The autocomplete attribute has the 'new-password' value.
Although, neither Firefox 70 nor Chrome 78.0.3904.70 on macOS 10.13.6 suggested a new password generation at first try.
I managed to get it working on FF after enabling new password generation in the config, but it wasn't enabled by default.
Couldn't get it to work on Chrome, though.
Let me know if there's anything I can help with, but on my end, +1
Cheers!
Comment #4
kostask commentedThe patch looks good, it adds the autocomplete attribute with value 'new-password'.
on MacOs:
FF 70 does indeed prompt to generate a secure password
Chrome & Safari 78 did not try to autocomplete the password
but Canary did try to autocomplete the password.
As it offers a better UX for modern browsers I think this is RTBC.
Comment #5
alexpottAdding credit for @kostask and @joum both of whom provided evidence of testing the patch.
I see no harm in adding this. But one thought that needs to be considered is whether or not the
password_confirminput is solely used for new passwords. In core it definitely is but what about contrib. I've searched http://grep.xnddx.ru/search?text=password_confirm&filename=&page=4 and cannot find any examples in contrib where it is been used for existing passwords. And even if so then the value would be filled and then autocomplete does not mean anything. So this looks good.Comment #6
alexpottCommitted and pushed 7403764a0c to 9.0.x and b36cfe8528 to 8.9.x. Thanks!