Web page login input field labes are missing "for" attributes

[varjolintu]

Pre-checks

• This is not a feature request. Existing functionality does not work as intended, not missing functionality. I will request features via discussions, reddit or support
• I've searched and did not find a similar issue.
• My report does not have personal or private information like email address or recovery code

App version

327.260213.0

Browser

Edge

Browser version

145.0.3800.58

Operating System

macOS

What happened?

Inputs on the login form has elements but those are missing the for attributes. Modern password managers check for topmost element to prevent DOM hijacking methods, and your login page fails this because these label elements cannot be identified as related to the inputs. These labels should be modified for better compatibility with password managers.

Related KeePassXC-Browser side report we just received: keepassxreboot/keepassxc-browser#2874

Other context

No response

[ganthern]

Hey there 👋

Am I understanding correctly that connecting each label to its corresponding input field with the for attribute would solve your issue?

I'm a bit confused how this works, since (1) someone hijacking the DOM could also hijack labels, (2) trying to determine what's a password input by reading the associated label seems like a hack that's liable to break as soon as I switch my client's language - that's what autocomplete attributes are for and also (3) how is the for attribute related to ordering of the elements on the page?

[varjolintu]

Yes, that would solve the issue about the topmost element check. When setting for attibute to input, it can be requested with input.labels from JavaScript. Our extension checks inputs from multiple sections and see if there are elements that are trying to cover it. This is not to used to check what is a password input etc., but it's just one of precautions when parsing the page inputs.

We can bypass this by selecting the input field manually from the extension's own selector, so this change request is not actually required. Just nice-to-have :)

[charlag]

Is this duplicate of #10274 ? I think we don't use for normally because it needs IDs