On 06/08/2021 16:42, Rene Veerman
wrote:
---------- Forwarded message ---------
From: Rene Veerman <rene.veerman.netherlands@xxxxxxxxx>
Date: Fri, Aug 6, 2021 at 1:05 PM
Subject: Fwd: storing and using sensitive data
To: PHP General <php-general@xxxxxxxxxxxxx>
FYI :i've read https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach which explains a lot of the pitfalls involved,then i went searching for a library that does this for you, and found https://github.com/gbirke/rememberme which appears to work great right of the box.
i'm now stuck at the autofill functionality.my site https://nicer.app, with the login button at the top-left of the pages, the middle icon on the right-side of the date-time indicator,just won't autofill at all, other than offering a multitude of previously used usernames, but i can't for the love of anything get it to autofill the password field.
this is the same for <input type="password" id="password" name="password"> and <input type="password" id="current-password" name="current-password">
i could really use some help with that..
---------- Forwarded message ---------
From: Rene Veerman <rene.veerman.netherlands@xxxxxxxxx>
Date: Thu, Aug 5, 2021 at 6:30 PM
Subject: storing and using sensitive data
To: PHP General <php-general@xxxxxxxxxxxxx>
Hi.
I'm building a webmail module for my MIT-licensed https://github.com/nicerapp/nicerapp websites platform (CMS and more, see https://nicer.app for a demo).
I don't want to store end-user's email connection settings in plain text on my server.
I've read all of https://github.com/defuse/php-encryption, understand most of it, but wonder if I can just encrypt the data using the end-user's password, which gets verified by couchdb and as such is only stored as a hash value in the database.
Will my SSL connection setup, and the password stored in a cookie in the end-user's browser, keep things safe enough to survive a PHP/apache-based intrusion, which tends to open up every 2 years when the guys at ubuntu.com prepare for a new release..
With regards,Rene Veerman
Autofill tends to work based on the name and id of the field in
question, and this behaviour varies quite a bit between browsers
and operating systems. Have you looked at the `autocomplete`
attribute
(https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete)
for that form element? In theory, you _should_ be able to set that
to "current-password" to trigger the autocomplete behaviour.
However, this is not a guarantee, it's just an attribute which
suggests to the browser to do that, not an instruction that the
browser must follow.
-- Ashley Sheridan https://www.ashleysheridan.co.uk
