Home/ Questions/Q 3795904
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-19T13:09:15+00:00

I have a typical login form with username and password. When a user enters

  • 0

I have a typical login form with username and password. When a user enters this information, their web browser will save the username and password for them (assuming their browser is configured to allow this). Suppose the username is “User01” and the password is “Password01”.

Now suppose the user changes/resets their password to “Password02”. The web browser doesn’t recognize my password reset form as a login form, so it doesn’t update/change/save the password in the user’s web browser.

So when the user leaves my website and comes back at a later date, they come to my login page. They enter their username “User01” and it autocompletes the wrong password of “Password01” but the user doesn’t know this because they just see ****. The user eventually locks their account then calls up our customer service to yell at us.

<form action="updatePassword.php" name="frmPasswordChange" method="POST">

<label>Old Password</label>
<span class="textbox"><input type="password" maxlength="14" size="14" name="oldPassword"></span>
<br />

<input type="hidden" name="username" value="User01">

<label>New Password</label>
<span class="textbox"><input type="password" maxlength="14" size="14" name="newPassword"></span>
<br />

<label>Re-enter New Password</label>
<span class="textbox"><input type="password" maxlength="14" size="14" name="newPasswordReEntered"></span>
<br />

<span class="buttonHolder">
<button type="submit" class="styledButton updateButton">Save Password</button>  
</span>

</form>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I think that the way a browser handles inputs is largely from semantical reading of the login form. That is to say, if a text field is named “username” and a password field is named “password”, that tends to carry over.

    Problem in your case is that it sounds like you have two different pages through which one can login. It is a known issue/feature that web browsers associate login info on a page-to-page basis. For example, one of the sites I regularly login to stores different login credentials between the homepage and the forgot password page (with the “forgot password” page, somewhat ironically, having the correct credentials).

    Until some sort of standard is developed that allows linking of forms by something like the ID attribute, I’m going to posit that there’s not much you can do about this, apart from maybe doing a quick IP read and giving the username. But that would be stunningly bad practice.

    • 0