Delete saved login credentials username and password

Question

Scenario:

Alice uses my website on her own computer and sometimes also on a computer that Mallory also has access to. Alice likes using the password manager built in to the browser. She is aware that she needs to be more careful on computers that others also use.

Is there a way that I can provide a button to forget Alice's login details after she has finished (both username and password)? If she doesn't do this, Mallory has the ability to retrieve her login details.

There are thousands of Alices using my website, so I'm going to assume that trying to educate them all is a losing battle. I'm looking for a solution that works with human behaviour, not against it.

Answer 1

If I'm not mistaken, the browser only saves the information if it is there when either the AJAX request is sent or the page changes.

Now I'm going to get slightly technical given that this isn't StackOverflow, but I won't go into too many details as you should post it there if you have code related questions, but given what you want the process could go like this for a state handling library like React:

1. the user presses submit.
2. you delay the execution of the page change/login/ajax request.
3. you save the information to some state (or a variable).
4. you set the values of the boxes to generic "user" and "****".
5. You send the request and log in the user.

I'm not exactly certain if this will work with every browser, but I have noticed that websites tend to do something similar quite often. I will admit that this is highly dependent on the browser, but it always will be and I honestly don't think that browsers are smart enough to know the difference, and if they are, just place the submit button outside of the form (if preventDefault doesn't do the trick first).

Answer 2

A website certainly can't tell a browser to delete (or, indeed, to remember) any credential; that would be an enormous security flaw in the built-in password manager. If a user saves a password they didn't mean to save, the only option is to go into the password manager and manually delete it from there (or delete all saved passwords, but that would presumably upset the device's owner). Users can protect themselves in other ways, such as using a private/incognito browser session, but they have to remember to do that before logging in.

However, you can (probably) prevent the browser from offering to save the password in the first place by copying the HTML login form contents into JS variables and then clearing the HTML input elements, before submitting a scripted request containing the copied credentials using generic names for the values. You should obviously only do this if the user specifically indicates they don't want the credentials stored (e.g. by indicating that the machine is a shared device via a checkbox on the login form). I caveat this with "probably" because there's no standard around how password managers recognize login attempts, and a sufficiently clever one might be hard to fool (though it would probably also throw a lot of false positives).