Skip to content

Credentials re-fetched on every tab switch back to pages with hidden login forms (SPA post-login) #29

@alan-null

Description

@alan-null

After logging in on a single-page application (SPA), the login form's input fields remain in the HTML DOM but are hidden via CSS/JS. When the user switches to another tab and switches back, the extension re-fetches credentials from KeePass unnecessarily — even though the user is already authenticated.

Steps to Reproduce

  1. Open a web application that uses a SPA login flow (e.g. the login form is shown/hidden dynamically without a full page reload).
  2. Have KeePass running with chromeIPass connected and autoRetrieveCredentials enabled.
  3. Log in to the application. The login form fields become hidden but remain in the DOM.
  4. Switch to any other browser tab.
  5. Switch back to the logged-in tab.
  6. Observe in the KeePass notifications / network traffic: a retrieve_credentials request is made even though the user is already logged in and no login form is visible.
  7. Repeat steps 4–6 — the request fires every time.

Expected Behavior

After logging in, switching back to the tab should not trigger a credential retrieval. If the login form is no longer visible, the extension should recognise there is nothing to fill and remain idle.

Actual Behavior

retrieve_credentials is sent to KeePass on every tab focus, regardless of login state.

Fix

Reset _called.initCredentialFieldscip.urlcip.submitUrl, and cipFields.combinations inside cipEvents.clearCredentials(). This forces cip.init() in triggerActivatedTab to re-scan the DOM. If the login form is now hidden, no visible credential fields are found, cip.url is never set, and the spurious retrieve_credentials call is skipped.

Metadata

Metadata

Assignees

Labels

🐛 bugSomething isn't working

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions