Auto-Complete Password with Password Manager

Summary

When filling a username/password combo from a password manager, it only fills the username, not the password, because the HTML password field has the property autocomplete="new-password". Removing this property results in the expected behaviour.

Steps to reproduce

Code snippet:

import streamlit as st

sender_email = st.text_input('username', value='user', key='email')
sender_password = st.text_input('password', type='password', key='password')
if st.button('Login'):
    st.success('Logged in')
else:
    st.write('Not logged in')

1. Run the code
2. Notice that 1Password 7 displays for the user field the saved password and for the password field only suggests a new password
3. Fill saved password from the user field. Notice that the password field does not get filled.
4. Reload the page.
5. Remove the autocomplete="new-password" property with the web inspector.
6. Fill the password from the user field. Notice that both fields get filled (as expected).

Expected behavior:

The password manager fills both fields

Actual behavior:

The password manager only fills the user field.

Is this a regression?

Don’t know.

Debug info

• Streamlit version: 0.79.0
• Python version: 3.9.2
• Using Conda? PipEnv? PyEnv? Pex? => Conda
• OS version: macOS 10.15.7
• Browser version: Tested with Safari 14.0.3 and Chrome 89.0.4389.90

Is there a workaround to remove this HTML property? Or does it required a code change within Streamlit? For my tool the user needs to provide a API authentication for the backend (username/password), which will be stored in a password manager (1Password 7) in this case. It is inconvenient having to copy the password manually.

Thank you!

[jroes]

Dropping this reference here in case it’s useful: https://developer.apple.com/documentation/security/password_autofill/enabling_password_autofill_on_an_html_input_element

[vdonato]

Hi @hyerrakalva, wanted to give you an update on this (sorry for the delay!). I ran this by our product team, and our gut feeling is that we’ll probably want to have password fields be configurable so a developer can specify whether the password is a new or existing one. Ideally, we’d want the default to be that it’s treated as an existing password since that’s certainly the more common use case, but we’ll most likely have to default to the current behavior to preserve backwards compatibility.

We’ll try to get a spec for this out sometime next week, at which point it’ll be free to take if you still want to work on it!