Cockroach: UI: ensure password managers are happy with the login form

[mberhault]

Two things when I try to login:

• lastpass does seem to detect that this is a login and does not offer to save the username/password
• when clicking 'login', LastPass throws LastPass detected a login form that is insecure

According to the LastPass docs:

This means that the webpage you are on uses an insecure method to submit data.
We specifically look for GET and mailto: methods on the page

This happens on adriatic which has a real server certificate for the Admin UI.
This was tested on Chrome 68.0.3440.106 for Linux, LastPass Chrome Toolbar: 4.17.0.

[mberhault]

@couchand: I think I mentioned this a little while back. There's definitely no rush but a good answer to anyone complaining about having to login is: in this day and age, everyone should use a password manager. Making sure the popular password managers are happy would be of great help.

[vilterp]

Don't really understand why it's unhappy, since we're doing a POST over HTTPS…

[mberhault]

I know, it's a bit weird. Also the fact that it doesn't recognize it and offer to save it. I believe those are separate.

[mberhault]

Someone out there suggests sticking an explicit method="post" in the form field. Not sure if we actually do.

[mberhault]

Only one issue out of two: turns out I had the entire domain in Never Fill.
It now correctly prompts to save the credentials. However, it does not autofill.
Adding method="post" attribute to the form (through browser edit) gets rid of the Insecure form warning.

[mberhault]

To enable auto-filling, we need to add name attributes to the username and password input boxes. When done, LastPass shows the field name in the "advanced" view of a saved entry. It should work to auto-fill.

[couchand]

@piyush-singh I suggested that we close out this issue, since the only actionable details were related to LastPass. Pete had originally planned to keep it open to reflect the same concern regarding other password managers. If we have time before the release, it might be a good idea to spend a few minutes checking a few of the other popular ones.

[piyush-singh]

I did see some concerns with 1password mentioned, but hopefully the changes for LastPass would address them. I happen to use 1password, so I will test that out on Adriatic and file an issue if I notice anything wonky.

[piyush-singh]

@couchand confirmed that 1password now works with Pete's changes on Cyan.