disable 'remember password'

Anon

I want to DISABLE the possibility that the user
remembers his password with the browser.
How can I empty the password-field in the auth-popup
screen?

[deleted]

You can't.

jc94062

One way of doing it, albeit not with .htaccess is to have a standard login form, with username and password, and put the usernames in a dynamic pull down from a db.

When they select their username, the password doesn't automatically appear, the save password feature isn't available.

Note
I don't know if Gator would override this...

As Vincent said though, can't do it with .htaccess...

Why are you trying to do it though, I may have a better suggestion if I knew why you were trying to disable that feature.

dannys

You could use SSL as IE's save password feature doesn't (well shouldn't) happen on https domains.

Or you could give your password field a unique name, making a different field name every time the page is accessed.

Example:

<input type="password" name="passwd5454" value="">

In the script called by the login page you could access the password variable's contents by using $$passwdId

HTH

Anon

Danny, that's a nice solution; I'll have to remember that for possible future use. But good grief, the stuff we have to do to cancel out IE's misfeatures!

dannys

Yeah, M$ will keep us all employed in one way or another 🙂

Anon

I'm creating a small intranet for the office and I don't want anybody to be able to login on a computer while somebody is away for a while.
With the "remember password"-function of the auth-popup screen anybody could login.
Maybe I should do it with a standard login-form I create myself and use Danny's idea about the unique password field name.

Anon

As far as I can tell, even a unique password ID doesn't stop MSIE from autocompleting an HTML form if the browser's "Autocomplete" features are enabled. 🙁

At least, it doesn't work on my copy of IE 5.5 on Windows NT 4. Even with a uniquely named password field like "authFormPassword1010691058" every time the page is generated, IE somehow populates the form correctly; maybe it stores form information based on the page URI and form field lengths rather than the form field names?

Anyway, some further snooping came up with this page:

http://www.seifried.org/security/www-auth/section-7.html (section 7.1.2)

To keep IE from storing form info, add AUTOCOMPLETE="OFF" to the FORM tag.