How can I stop the password field being pre-populated on edit?

Question

I have this problem all the time in my rails apps and I still need the correct solution. Whenever a user edits their own record the password field is being populated. I suspect its Firefox as setting @user.password = nil in the edit action doesn't help.

The problem is the password confirmation isn't populated so validation fails due to a miss-match.

I've tried the following:

<%= f.label :password %>
<%= f.password_field :password, :value => "", :autofill => false, :class => 'max' %>

But that doesn't do it. I've also tried :autofill => 'off' which doesn't work either.

Does anybody have any suggestions? Thanks.

Derange

Answer 1

Set autocomplete="off" in the form and the input tags

<form name="blah" autocomplete="off">
<input type="password" autocomplete="off">
</form>

Exaggerate

In Ruby for copy and paste lazy people like me: <%= form_for(user, :html => { autocomplete: "off" }) do |f| %> – Overtone

This solution does not work with old browsers, like ie7 or ie8 – Orndorff

This doesn't work for me (chrome 47.0) but for more details see developer.mozilla.org/en-US/docs/Web/Security/… – Wail

Answer 2

The line f.password_field :password, :value => '' didn't work for me (on rails 3.1). Although I coud empty the field with f.password_field :password, :value => nil.

Regards

Tailor

Answer 3

There are two solutions:

1. tell firefox not to fill those fields;

2. give password field a different name from "password".

Enloe

1. I cannot control the user. 2. Great idea which I'm sure would work, however I would have to modify the password field in quite a few projects, some with AuthLogic, some with RA etc etc. – Derange

Answer 4

The HTML options are in their own hash so the syntax should look like this

<%= f.password_field :password, { :value => '' } %> 

This should replace the value attribute in the response HTML.

Paulin

Thanks for the response although the syntax is perfectly valid as it is. The list of parameters after the method are still a hash without or without the brackets. Look at these examples: apidock.com/rails/ActionView/Helpers/FormHelper/password_field – Derange

When last parameter is an hash, brackets are optional; neither mandatory nor forbidden. – Enloe

True enough, thanks for pointing out my own syntactic hangup. The :value => '' should be all that is needed though. – Paulin

Thank you! This should be marked as the correct answer (for Rails 3.2.x), because RoR's built in <%= form_for(@model) do |f| %> ... does not accept :autocomplete => "off" directives. – Inca

Answer 5

As a field option, you can pass it like this

<%= f.password_field :password, {:autocomplete =>"off"}  %>

Becerra