Submit Hint Search The Forums LinksStatsPollsHeadlinesRSS
14,000 hints and counting!

Force Safari to save sites' autofill-blocked form data Web Browsers
Some bank websites use the property autofill=off in their web forms to tell browsers not to remember your password. I find this really annoying and wanted it to stop. It turns out you cannot override this setting with a custom CSS file, so another solution is required. We are going to intercept the page before Safari gets it, and remove all of the autofill=off tags.

Read the rest of the hint for my solution...

Here is my quick fix:
  1. Turn on personal web sharing (System Prefs -> Sharing).

  2. Create the following plain text file and save it in your user's Sites folder as remember.php:.
    <?php
    $server = str_replace("/*", ".com", $url);
    $wells = file_get_contents($server);
    $wells2 = str_replace("autocomplete=\"off\"", " ", $wells);
    print "$wells2";
    ?>
    
  3. Create the following plain text file and save it in the top-level /Library -> WebServer -> Documents folder as index.html:
    <SCRIPT  LANGUAGE="JavaScript">
    var currentLoc=window.location;
    window.location="http://localhost/~yourUserName/remember.php?url=" + currentLoc + "*";
    </script>
    
  4. Edit your /etc/hosts file and add a line for each site you want to be stripped. For example:
    127.0.0.1 wellsfargo 
    
    Notice that the .com is missing.

  5. In the Terminal, type sudo killall -HUP lookupd to restart the lookup services.

  6. Restart Safari.
Now when you want to access wellsfargo.com and have it remember your password, type wellsfargo in the location bar and hit enter. All of the autofill=off tags will be stripped out, and Safari will remember your username and password.
    •    
  • Currently 2.75 / 5
  You rated: 1 / 5 (8 votes cast)
 
[45,793 views]  

Force Safari to save sites' autofill-blocked form data | 41 comments | Create New Account
Click here to return to the 'Force Safari to save sites' autofill-blocked form data' hint
The following comments are owned by whoever posted them. This site is not responsible for what they say.
Force Safari to save sites' autofill-blocked form data
Authored by: ulrich on Oct 15, '04 11:44:51AM

There is a reason why banks use this in their forms: SAFETY!!! Why would you want your browser or computer to store your passwords anyway.
Your brain is the best and most secure database. Nothing gets lost, just sometimes unretrievable. ;)



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: Azark on Oct 15, '04 12:42:16PM
Why would you want your browser or computer to store your passwords anyway.
Are you joking?
I personally need my mac to remember my numerous passwords!
BTW, it's not the browser which "remember" the pw but the keychain.
And that's what it's for, no? To have one password to access all the others.
Nobody can't access it without my account pw anyway.

I access my bank account thru a local app anyway, but this trick is useful for admin console login at certain Internet hosts. When you have to manage numerous accounts this really make life easier.

---
PB Ghz 1024MB Combo 10.3.5
G4 400 AGP 512MB 10.3.5
G4 400 AGP 768MB OSX Server 10.3.5

[ Reply to This | # ]

Force Safari to save sites' autofill-blocked form data
Authored by: hembeck on Oct 17, '04 01:27:03PM

Maybe I don't know how keychain works, but whenever I go to a site that I have saved the login info for, Safari/Keychain just autofills the id & password. The only time it asks me what to do, is after I've rebuilt permissions, following an OS update. When this does happen, it just asks whether I want to deny this action, allow it once, or always allow it. No password is requested.

Again, maybe I don't know how Keychain is supposed to work, but I would like it to ask me for a password, but it never does.

-Fernando

---
--Health, Wealth and Happiness--



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: elmimmo on Oct 17, '04 06:29:20PM

It's quite obvious if you open up Keychain access and wander around. You are being lazy.

Two options:
- Keep the whole keychain permanently locked going to Edit > Change settings for keychain "login" (or whatever other keychain you'd like to secure. Tick "Lock after 0 sec of inactivity". You will be prompted to enter your keychain password every time any application tries to access it.

- Secure individual keys. Select a key, go to "Access control" tab, and remove Safari from the list of applications allowed to access that item.

I have not actually tried that out, so smooth any quirks yourself.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: charlie on Oct 15, '04 08:55:04PM

My brain is full of this banks stuff, I need auto-fill!

---
Mac, period.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: covisp on May 14, '06 06:52:36AM

Safety? Yeah, having to have a password written down on a piece of paper somewhere near my computer is real safe.

Idiots.

I feel a lot more secure with my keychain than with my memory, thank you.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: 5chm31din6 on Oct 15, '04 11:56:08AM

Surely some of you smart AppleScripterz can devise a script that will do the same thing? It would be cool to do it that way instead of having another running process on my machine. You what I'm saying? I think you do.

---
Power corrupts. PowerPoint corrupts absolutely.

[ Reply to This | # ]

Force Safari to save sites' autofill-blocked form data
Authored by: doggkruse on Oct 15, '04 12:20:15PM

Another solution is to use privoxy, but this solution is much more complicated to set up. This still requires an extra process running, but you don't have to have web sharing on. See privoxy.org



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: momerath on Oct 15, '04 01:26:31PM

This might be a good situation for PithHelmet 2.0's new "Machete" dynamic page modification scripting. It would probably be easier to implement.



[ Reply to This | # ]
Machete Script Kind?
Authored by: 5chm31din6 on Oct 15, '04 06:37:24PM

Yeah, but how? Is Machete expecting AppleScript? JavaScript? A shell script? I can't find any reference in the documentation other than the sentence, "Run script on the contents of the main url before it gets rendered by the browser."

---
Power corrupts. PowerPoint corrupts absolutely.

[ Reply to This | # ]

Machete Script Exlanation
Authored by: msolo on Oct 15, '04 09:07:47PM

Machete runs unix-style shell scripts in perl, python or bash.

http://culater.net/wikir/wikir.cgi?mode=read&arg=PithHelmetExplanation

There is a sample script AllowAutofill.py that should do exactly what you want available on that page along with a brief explanation on how to install it.



[ Reply to This | # ]
Machete Script Exlanation: Thanks!
Authored by: 5chm31din6 on Oct 17, '04 04:55:52PM

Thanks, msolo. His site is little too difficult to navigate.

---
Power corrupts. PowerPoint corrupts absolutely.

[ Reply to This | # ]

PithHelmet machete
Authored by: sjk on Dec 03, '04 01:25:12PM

Yep, a PithHelmet machete script works nicely for this. I also use one to strip accesskey tags that annoyingly interfere with Emacs-style control key shortcuts during text editing, especially on several forums.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: karim on Oct 15, '04 02:56:53PM

If you use OmniWeb instead of Safari for these type of sites, there is a much easier solution.

Go to the site you want to use, edit the source code and remove the autocomplete=off parameter, tell OmniWeb to redisplay the page. Then enter your username and password and tell OmniWeb to save it. That's it! From now on, whenever you go to that site with OmniWeb, it will enter your username and password from your keychain.

Please note that for some sites you might have to use OmniWeb's site preferences and identify your browser as Safari or IE.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: vocaro on Oct 16, '04 01:20:27AM

You shouldn't need to do that. OmniWeb 5 ignores autocomplete by default. At least it's been doing that ever since I installed it.

Trevor



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: n9yty on Oct 16, '04 12:07:14AM

Oh yes... FINALLY! :-) I did string searches, and looked at everything I could think of to stop Safari from doing this, never came up with anything. THANK YOU.

Technical tidbit: Looked at the PithHelmet suggestion and Machette script. I had to tweak it slightly to strip out "AUTOCOMPLETE" as well as "AUTOFILL", or some sites still wouldn't save the information.

Now, on to the rant...

The concept that a webmaster somewhere knows better about how to manage my information than I do is absurd... I realize that for people running Windows, security of "stored passwords" may be easy to break, but on the Mac with keychain storage I don't think you run the same risks. I have mine set to re-lock after 15 minutes of inactivity, and also when the system goes to sleep.

Basically, this lets me properly have the computer do it's job, keeps people out who don't know my keychain password, and prevents me from having to store all the passwords in a stupid text file or something like that. It also lets me use unique passwords on many sites, since I no longer have to remember manually which are which, and that really improves security.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: vocaro on Oct 16, '04 01:45:07AM

I completely agree. The autocomplete attribute is a non-standard Internet Explorer extension, and it should not be used. This is why Mozilla provides a setting called wallet.crypto.autocomplete.override. When true, it tells Mozilla to ignore the attribute.

There's a catch, however. If a web site uses autocomplete=off and knows that a certain browser ignores the setting, the webmaster may decide to block users of that browser. This is why Mozilla ships with wallet.crypto.autocomplete.override off.

Camino users are in even worse shape: It doesn't even support the setting to begin with! That's why I wrote a patch to add autocomplete override support in Camino: https://bugzilla.mozilla.org/show_bug.cgi?id=247919

Unfortunately, it still has not been committed. For this and other reasons, I have since switched to OmniWeb, which ignores autocomplete by default, just as a good web browser should.

Trevor



[ Reply to This | # ]
Camino
Authored by: Rainy Day on Mar 06, '06 08:48:03PM

The current release of Camino ignores autocomplete (as every browser should, IMO).



[ Reply to This | # ]
Camino now ignores it
Authored by: Rainy Day on Mar 06, '06 08:50:46PM

Should have said it in the title in my first post; no way to edit.

Camino now ignores the autocomplete, as all browers should (IMO).



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: jzsimon on Dec 01, '04 05:18:26PM

Can you elaborate on the change you made to AllowAutofill.py? I don't know python but I'd love to use your change too.



[ Reply to This | # ]
Please help
Authored by: filmsmith on Oct 16, '04 01:37:51AM

I thought I did everything as the script said, but I still can't get this to work. My problem is that I know little to nothing of the terminal and tried to do most everything with text edit. I've verified all the steps, yet seem to run into a problem when checking to see if the index.html file has what it says it should have. When I open it, however, it's empty. Everything else is where it should be and as it should be. ...to the best of my knowledge, anyway.

I have no idea how to continue. Would someone please help?

thanks



[ Reply to This | # ]
Please help
Authored by: doggkruse on Oct 16, '04 03:16:12AM

the index.html file that you need to edit is in /Library/WebServer/Documents . Note that this is no the same as the index.html in /Users/yourUserName/Sites. This file is owned by root which means in order to edit it, you have to have root privileges (which text edit does not)

Using the program called skeleton Key, you can run text edit as root and you will be able to change the file.

It can be found at http://versiontracker.com/dyn/moreinfo/macosx/11927



[ Reply to This | # ]
Please help
Authored by: filmsmith on Oct 18, '04 12:23:54PM

Thanks for the application, but I still can't get it to work. I'm saving the index.html to the proper place, but when I save a plain text file and then rename it index.html, all of the information that I pasted in the text file is wiped out. I've verified this by trying to re-access said information.

Can anyone help me figure out what I'm doing wrong?

Thanks.



[ Reply to This | # ]
This works?
Authored by: reh on Oct 16, '04 01:29:51PM

Are you sure this works? I know my way around the terminal and webservers, but this just breaks instantly.

Safari just displays the contents of remember.php, so I stuck some html tags around it. Now I just get a url of http://localhost/~reh/remember.php?url=http://wellsfargo/* because safari adds "http://" and "/" to the wellsfargo bit.

I tried working on the two files, but my javascript and php skills are still rather limited.

---
12" iBook ~ 800MHz G3 ~ 640MB ~ 30GB ~ Combo drive ~ Panther

[ Reply to This | # ]

This works?
Authored by: doggkruse on Oct 16, '04 03:16:14PM

Make sure that php is installed on your machine



[ Reply to This | # ]
This works?
Authored by: reh on Oct 16, '04 03:46:32PM

Yeah, I kinda figured that was the case when I couldn't even get "Hello World" to print. BUT, I've come up with a MUCH simpler method of accomplishing this.

Stick the following text into a file called something like autocomplete.php on any webserver with php. I'm using my purchased webspace.

<?php print str_replace("autocomplete=\"off\"", " ", file_get_contents($site)); ?>

Then go to the following url (using Wells Fargo as an example)

http://www.mywebserver.com/autocomplete.php?site=http://www.wellsfargo.com

Voila! Only one line of code and no /etc/hosts tinkering. Citibank is being problamatic though. I'm still working on that. Also, the autologin information is stored under your domain name in the keychain, but that shouldn't be a problem since safari can handle multiple logins on the same domain.

---
12" iBook ~ 800MHz G3 ~ 640MB ~ 30GB ~ Combo drive ~ Panther

[ Reply to This | # ]

This works?
Authored by: jfrankov on Oct 27, '04 02:50:17AM

I had the same thing happen to me. I'm guessing that you have to have PHP extensions installed somewhere. Does anyone know if I'm right and if so, should I grab an OS X build from php.net?

---
--
Jason Frankovitz



[ Reply to This | # ]
Not sure if this works in Safari...
Authored by: jrono on Oct 16, '04 06:10:38PM
Here is a bookmarklet that does something similar. It doesn't work for me in Safari, but I have used it in Firefox.

[ Reply to This | # ]
Not sure if this works in Safari... Thanks!!!
Authored by: sr105 on Oct 17, '04 09:26:26PM

I've been trying to get the very same wells fargo page to remember my login and password since what seems like forever. This bookmarklet worked perfectly (with Firefox). To make it simpler for others:

Go to the link given in the previous post. Click and drag the "remember password" grey box into your bookmarks toolbar. Then load http://www.wellsfargo.com. Now click on that "remember password" link in your toolbar. It should say something like this:

"Removed autocomplete=off from 1 form and from 2 form elements, and removed onsubmit from 0 forms. After you..."

Enter your username and password. The password save dialog should show. Voila!

Thanks again,

R.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: atverd on Oct 18, '04 12:33:40PM

To make a good solution for this problem it should be implemented on browser level just because of https - external proxy/filter cannot tamper encrypted traffic and autocomplete removal will not work in this case.

The best way would be some safari plugin, also it's possible to hack WebCore and make it forget about this AUTOCOMPLETE nonsense (I've done this one on my laptop and it works fine so far).



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: doggkruse on Oct 19, '04 12:22:34AM

Do you have a more detailed explanation on how you did this? I have run into the https:// problem on one of my bank sites. Pithhelm i think works like this, but i had problems setting it up.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: atverd on Oct 19, '04 12:57:45PM

In brief. If you don't understand something than simply don't do it and ask someone who knows how to deal with a binary editor.

1. Quit Safari and you'll need HexEdit.
2. Find original (not link/alias) WebCore file in some subdirectory in /System/Library/ .
3. Make a backup of the file.
4. Open it in HexEdit, find words "autocomplete" and "AUTOCOMPLETE" (both should be surrounded by \0 !!!)
5. Replace first character of both words with some other character.
6. Save changes.

This is it - very simple hack, works fine for me with AmEx and Citi.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: Puzo on Nov 11, '04 01:00:22PM

After recent update (10.3.6) this hack is not working anymore. Any suggestions?
Thanks.



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: Puzo on Nov 11, '04 01:23:29PM

Sorry for causing the panic! I needed to reboot the computer after I "hexed" the WebCore - all is well now :)



[ Reply to This | # ]
Force Safari to save sites' autofill-blocked form data
Authored by: gepdog on May 15, '05 05:59:30PM

Brilliant -- and one of the best tips on this site. As far as I know, MacOSXHints is the only place this is documented. Worth noting is that it may need to be re-done after installing Mac OS X's periodic system or security updates. I applied this hack to Safari (v2.0) in Tiger, and it still works.



[ Reply to This | # ]
Use "Autocomplete Always On!"
Authored by: Rainy Day on Apr 07, '06 11:15:00PM
Even easier, just use Autocomplete Always On! It's a simple little program which will implement the WebCore patch.

 :-)



[ Reply to This | # ]

Force Safari to save sites' autofill-blocked form data
Authored by: cssbz on Jan 12, '05 07:20:08AM

I have the autofill-blocked problem with a few websites (described below), and I suspect that the hints described so far won't work, since these sites don't seem to contain autocomplete=off in their HTML.

1) <https://bishop.34sp.com:8443/login.php3> seems to use two forms, one for username, one for password. Some Javascript combines the information together into one form before submission.

2) <http://webcat.warwick.ac.uk/patroninfo> - I don't understand why Safari doesn't offer to save my barcode and PIN...

3) I have a NetGear "Wireless ADSL Firewall Router" (DG834G) which has a configuration interface that is locally accessible at <http://192.168.0.1/>. When I go to that URL, Safari gives a sheet prompting me for username and password, with a check box for "remember this password". (It also tells me that my password will be sent in the clear -- perhaps this is relevant?) However, checking the "remember" box doesn't seem to work -- when I visit that URL again, I have to re-enter the password again. Also, even though I have checked the box, nothing is listed under that URL in Safari Preferences -> AutoFill -> Edit User names and passwords. Could this be because the URL contains a numeric IP address?

I think I understand why Safari does not remember the codes in the first case, but I'd welcome explanations for the last two, and hints for how to get Safari to remember codes for all cases.



[ Reply to This | # ]
possible solutions
Authored by: ra5ul on Dec 05, '05 08:20:36PM

1. rewrite the code so it only uses one form, or use firefox.
2. rewrite the code fragment "input...type = PASSWORD" with "input...type = text" for one of the two fields.
3. i can't verify this problem on my machine.

i recommend pithHelmet machete scripts for code manipulation.



[ Reply to This | # ]
possible solutions
Authored by: cssbz on Jan 12, '06 11:16:13AM

Thanks, ra5ul. Following your suggestion, for site no 1, I rewrote the HTML as one simple form. I added a <base href="https://bishop.34sp.com:8443/"> tag in the <head> section and saved it as a local .html file. Now when I view that local file in Safari, I can log in from there, and Safari offers to and successfully saves the password. :)



[ Reply to This | # ]
A little App to do this for you
Authored by: Rainy Day on Apr 07, '06 11:08:10PM
Even easier, just use Autocomplete Always On! It's a simple little program which will implement this patch.

 :-)



[ Reply to This | # ]

Force Safari to save sites' autofill-blocked form data
Authored by: marriott on Mar 17, '11 05:16:42AM
An update from the year 2011: this problem now has a nice solution with the Safari extension autocomplete.

[ Reply to This | # ]