[PR #21868] [CLOSED] fix: SensitiveInput not capturing password manager autofill values #41942

New Issue

GiteaMirror · 2026-04-25T14:01:30-05:00

GiteaMirror commented

2026-04-25 14:01:30 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/21868
Author: @ym7cd
Created: 2/25/2026
Status: ❌ Closed

Base: main ← Head: fix/sensitive-input-autofill

📝 Commits (1)

f9eafa6 fix: SensitiveInput not capturing password manager autofill values

📊 Changes

1 file changed (+5 additions, -5 deletions)

View changed files

📝 src/lib/components/common/SensitiveInput.svelte (+5 -5)

📄 Description

Summary

The SensitiveInput component used one-way {value} binding with an on:change event handler. Password managers (e.g. Apple's iCloud Passwords Chrome extension) autofill the input's DOM value directly without triggering the change event, causing the Svelte variable to remain empty ("") while the field visually appears filled. This results in an empty password being sent to the backend, returning "The email or password provided is incorrect" even though the correct password is displayed in the field.

Changes

Replace {value} + on:change with bind:value for proper two-way binding that captures all value changes including password manager autofill
Add autocomplete and name as exported props (defaulting to 'off' and '') instead of hardcoding autocomplete="off", so parent components (e.g. the login form) can pass the correct autocomplete hints like current-password

Root Cause

<!-- Before: one-way binding + on:change (misses autofill) -->
<input {value} on:change={(e) => { value = e.target.value; }} autocomplete="off" />

<!-- After: two-way binding (captures all value changes) -->
<input bind:value {autocomplete} {name} />

The on:change event only fires on user-initiated changes with blur. Browser extension-based password managers set input.value programmatically without dispatching change or input events, so the Svelte variable never updates.

Test Plan

Login with password manager autofill in Chrome (iCloud Passwords / 1Password / Bitwarden extension)
Login with manually typed password
Verify autocomplete="current-password" is correctly applied on the login page password field
Verify existing SensitiveInput usages (API key fields etc.) still work with default autocomplete="off"

Made with Cursor

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/21868 **Author:** [@ym7cd](https://github.com/ym7cd) **Created:** 2/25/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/sensitive-input-autofill` --- ### 📝 Commits (1) - [`f9eafa6`](https://github.com/open-webui/open-webui/commit/f9eafa695d290fcea20e414a4b8498cb732fdcac) fix: SensitiveInput not capturing password manager autofill values ### 📊 Changes **1 file changed** (+5 additions, -5 deletions) <details> <summary>View changed files</summary> 📝 `src/lib/components/common/SensitiveInput.svelte` (+5 -5) </details> ### 📄 Description ## Summary The `SensitiveInput` component used one-way `{value}` binding with an `on:change` event handler. Password managers (e.g. Apple's iCloud Passwords Chrome extension) autofill the input's DOM value directly without triggering the `change` event, causing the Svelte variable to remain empty (`""`) while the field visually appears filled. This results in an empty password being sent to the backend, returning "The email or password provided is incorrect" even though the correct password is displayed in the field. ### Changes - Replace `{value}` + `on:change` with `bind:value` for proper two-way binding that captures all value changes including password manager autofill - Add `autocomplete` and `name` as exported props (defaulting to `'off'` and `''`) instead of hardcoding `autocomplete="off"`, so parent components (e.g. the login form) can pass the correct autocomplete hints like `current-password` ### Root Cause ```svelte  <input {value} on:change={(e) => { value = e.target.value; }} autocomplete="off" />  <input bind:value {autocomplete} {name} /> ``` The `on:change` event only fires on user-initiated changes with blur. Browser extension-based password managers set `input.value` programmatically without dispatching `change` or `input` events, so the Svelte variable never updates. ## Test Plan - [ ] Login with password manager autofill in Chrome (iCloud Passwords / 1Password / Bitwarden extension) - [ ] Login with manually typed password - [ ] Verify `autocomplete="current-password"` is correctly applied on the login page password field - [ ] Verify existing SensitiveInput usages (API key fields etc.) still work with default `autocomplete="off"` Made with [Cursor](https://cursor.com) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-25 14:01:30 -05:00

GiteaMirror closed this issue

2026-04-25 14:01:31 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#41942