Disable AutoComplete 1

[varnix]

Is there a way using a CFINPUT tag to set the page so that none of the browsers will offer to remember your values?

I know that with a regular INPUT tag you can add AUTOCOMPLETE="OFF", but this errors out on a CFINPUT tag.

Does anyone know of a way to do this?

Thanks!

 

[csteinhilber]

AUTOCOMPLETE probably isn't defined as a parameter of CFINPUT, so you'd have to stick it in a passthrough instead.

<CFINPUT name=&quot;...&quot; passthrough=&quot;autocomplete=&quot;&quot;off&quot;&quot;&quot; ...>

(you need the doubled-up quotes to escape the quote character within the passthrough)

should work. Whether it works for all browsers is another question. I thought autocomplete=off was strictly an IE thing.
-Carl

 

[genith]

This is great information! We are finding the need to do this to all of the PCs on our network. I am not familiar with CFINPUT, can you tell me where we would need to reference this line of code? We are running into an issue of multiple users on a single login (single profile) that access a secure website, and the option of saving passwords is a security risk for the information contained on that site.

Do you have any suggestions that might help us with this challenge?

 

[csteinhilber]

Well... I can really only address the first question... where CFINPUT would go in your code.

CFINPUT is ColdFusion's friendly replacement for the traditional INPUT tag for forms. In addition to producing a standard input tag, it also builds several javascript functions that facilitate client-side validation. Though it also necessitates that you use ColdFusion's CFFORM tag rather than the usual FORM.

If you use CFFORM and CFINPUT, the above CFINPUT would go where you would ordinarily place the INPUT tag within your FORM (where you want the field to appear on the page).

I never use CFINPUT, though. I prefer to use the standard HTML FORM and INPUT tags, and either use server-side validation, or build my own client-side validation.

In which case, you would simply add the AUTOCOMPLETE to the INPUT tag as an attribute:

<input type=&quot;text&quot; name=&quot;...&quot; autocomplete=&quot;off&quot; ...>

But whether that solves all your security issues, I don't know. For one, it only works under IE (which, of course, is the only place Autocomplete works anyway)... but won't affect Cookies, etc
Also, IMHO, and system that allows multiple users to login under the same "profile", but then expects to be able to set different security levels for those users is just asking for trouble. But, then, that's just me.

Finally... I'm not sure that AUTOCOMPLETE="OFF" is a valid attribute of INPUT TYPE="PASSWORD"... so you'll need to experiment with that.



-Carl

 

[NoWayIsThisInUse]

You need to mask your passwords... then autocomplete doesn't work anyway.

 

[Extras]

You could also use code to clear your cache to help things along?