The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Problem/Motivation
The autocomplete attribute should be added with the value of 'one-time-code' for the user to improve accessibility and UX.
We recently got this as feedback in an accessibility report, it will help screenreaders better understand the purpose of the inputs. (WCAG 1.3.5)
See also:
- A Drupal core issue adding helpful autocomplete values to other fields: https://www.drupal.org/project/drupal/issues/3181647
- Mozilla developer site documentation on valid autocomplete values including one-time-code
- A Google web developer blog encouraging the use of this autocomplete value (this includes more ideas like some javascript WebOTP feature that could be used, but IMO that is a feature beyond the scope of this issue)
- The caniuse.com page which says this is supported by 94.26% of browsers
Steps to reproduce
Proposed resolution
Remaining tasks
User interface changes
API changes
Data model changes
| Comment | File | Size | Author |
|---|---|---|---|
| #4 | 3456229-4.patch | 1.66 KB | nvandijk |
Issue fork tfa-3456229
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
changes
Comments
Comment #3
nvandijk commentedComment #4
nvandijk commentedCreated a merge request, adding the patch for own use.
Comment #5
greggles+1 to the proposal as a concept. I didn't review the code for completeness/effectiveness.
I think this should maybe go into 2.x first and then be backported to 8.x-1.x.
Comment #6
cmlaraLet’s target to 2.x first as a feature request.
I have not yet loaded in a browser to validate no unexpected/negative changes occur, though I would suspect the “worst” would now be a browser with an autofill integration might now pop-up a selector where it did not in the past.
Quick glance looks like this would also target the setup form. we might see auto-fillers populate that field now with the “old” code. Is there a way to indicate it’s a “new” token similar to “new-password”?
Comment #7
gregglesI added some more articles about this idea to the issue summary.
I think this feature is most valuable for sites that use SMS for sending the code, so might not be super valuable to the TFA module as it stands today.
@nvandijk I wonder why you added this to the TFAHotpValidation and TFATotpValidation but didn't add it to TfaSetupForm.php nor TfaDisableForm.php? It seems like it should be added in those 4 places instead of just the 2?
Comment #8
nvandijk commented@greggles, I was unsure of which branch to create a fork from, so mostly quickly added the fields I saw, apparently missing some of them. I saw the functionality was rewritten in the 2.x branch so did not take much time to create a 'proof of concept'.
Thanks for adding the links, I found the web.dev article as well about the SMS functionality. However when reading the technique specification for the autocomplete attribute, you will find it brings more benefits to some users. https://www.w3.org/WAI/WCAG21/Techniques/html/H98.
@cmlara There is not a new- or old- prefix available for the one-time-code value sadly.
Comment #9
jcnventuraThe good thing is that this feature seems to be used in 94% of the current browser market share: https://caniuse.com/?search=one-time-code
I'd say that is enough to consider this ready for being used.