'delete account' form section facilitates password managers to auto-delete account #9271

New Issue

GiteaMirror · 2025-11-02T08:33:45-06:00

GiteaMirror commented

2025-11-02 08:33:45 -06:00

Originally created by @KiaraGrouwstra on GitHub (Jul 25, 2022).

Description

i made an account on codeberg, a public gitea instance.
i perused through the account settings, to be logged out.
i found i couldn't log back in -- my account was gone.
after a few cycles i found this happened each time i visited /user/settings/account.
i then realized this related to my password manager, KeepassXC, another open-source project.
to facilitate automated login, i had enabled the convenience feature to auto-fill and auto-submit forms thru that, and its browser plugins (here: keepassxc-browser).

now, as a user, i find it undesirable to have tools automatically delete my account.

for what it's worth, knowing what happened, i was able to disable the auto-submit feature for that specific domain.
i'm new to gitea while i was already using KeepassXC tho.
it would seem somewhat horrifying to imagine the opposite scenario -- a long-time gitea user switching to KeepassXC (or others) then find out it deletes their accounts on gitea instances.

i'm aware this raises questions of responsibility, as this might be avoided in different ways:

not using gitea
gitea functioning differently
not using auto-submit features

arguably, gitea has made some effort already by having the relevant password input contain the autocomplete="off" attribute.
this may well be on the end-user having tools that ignore that.

nevertheless tho, i feel given the weight of the consequences, together with the ease of this mistake, it might be preferable in this case to attempt further steps to prevent such a scenario.

Gitea Version

v1.17.0-rc2

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

codeberg.org

Database

No response

Originally created by @KiaraGrouwstra on GitHub (Jul 25, 2022). ### Description i made an account on codeberg, a public gitea instance. i perused through the account settings, to be logged out. i found i couldn't log back in -- my account was gone. after a few cycles i found this happened each time i visited `/user/settings/account`. i then realized this related to my password manager, KeepassXC, another open-source project. to facilitate automated login, i had enabled the convenience feature to auto-fill and auto-submit forms thru that, and its browser plugins (here: [keepassxc-browser](https://github.com/keepassxreboot/keepassxc-browser)). now, as a user, i find it undesirable to have tools automatically delete my account. for what it's worth, knowing what happened, i was able to disable the auto-submit feature for that specific domain. i'm new to gitea while i was already using KeepassXC tho. it would seem somewhat horrifying to imagine the opposite scenario -- a long-time gitea user switching to KeepassXC (or others) then find out it deletes their accounts on gitea instances. i'm aware this raises questions of responsibility, as this might be avoided in different ways: - not using gitea - gitea functioning differently - not using auto-submit features arguably, gitea has made some effort already by having the relevant password input contain the `autocomplete="off"` attribute. this may well be on the end-user having tools that ignore that. nevertheless tho, i feel given the weight of the consequences, together with the ease of this mistake, it might be preferable in this case to attempt further steps to prevent such a scenario. ### Gitea Version v1.17.0-rc2 ### Can you reproduce the bug on the Gitea demo site? Yes ### Log Gist _No response_ ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? codeberg.org ### Database _No response_

GiteaMirror added the type/bug label 2025-11-02 08:33:45 -06:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#9271