onloadwff.js consistently interrupts debugging in chrome devtools

[TwoFistedJustice]

Frequently when I am trying to debug pretty much anything in Chrome devtools using the sources window, this file:
chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/onloadwff.js

opens up in the sources window and effectively prevents me from using devtools.

This happens even when I'm trying to work through toy-problems.

It is disruptive enough that I am considering uninstalling Lastpass.

I am using Windows 10 Enterprise

[shanklq]

I'm Effected too
Browser: Firefox 61.0.1 (64-bit)
Running Angular Application. localhost:4200

[TwoFistedJustice]

You need to set up a dev profile for chrome inside of Jetbrains. This solves the problem.

[niusz]

@TwoFistedJustice I frequently find this problem ,and even when I use blackbox script it still doesn't work. how can you solve this problem?

[jgrams]

I sidestepped the issue using Chrome browser in incognito mode while debugging, which disables all plugins.

[daiplusplus]

@jgrams Unfortunately I need to use LastPass when in Incognito mode so I have it enabled.

[aarondevon]

To solve this, I updated my LastPass settings to have the extension run only when clicked on.

[daiplusplus]

@aarondevon Which setting is that?

[aarondevon]

@Jehoel right click on the extension, then select "This Can Read and Change Site Data". Then select "When You Click the Extension". It was inaccurate for me to say I updated the LastPass settings. What I updated was the Chrome Extension settings for LastPass. Not sure how this works for other browsers.

[worc]

i ran into another issue with onloadwff.js where it's blocking for 2000ms on an onmouseup handler. the call tree isn't especially deep, it includes a getUsername and a getText call. which i think are walking nearly the entire DOM tree looking for something? it takes a long time and generates 500ms of garbage collection.

a comment on this stackoverflow question seems to indicate it's a deep walk looking for places to inject the lastpass icon.

thanks for these clues ... turns out its lastpass trying to inject its icon into the usr/pwd fields ... so just need to turn off lastpass for given website ... lastpass > account settings > Never URLs > Add > Never Show context Icons > your.domain.com > Add ... then logout of lastpass plugin in chrome and log back in again ... and the website you want to continue developing needs to be opened in a new chrome window before lastpass plugin starts respecting the rules and leaving it the heck alone ... a new tab just doesn't cut it – pulkitsinghal

[Valstorm]

If you're using chrome you can filter out these errors in the console and still keep LastPass activated with this regex:

/^(?!onloadwff).*$/

[megsaysrawr]

Thank goodness for this thread! I was having a really tough time debugging some code and had no idea what was wrong... @aarondevon's solution of changing the Chrome Extension settings fixed this for me!

[sgehrman]

Can't find this preference. Why don't you guys just fix the bugs?

[robclancy]

Finally decided to find where this console spam came from. Like usual it's something reported and ignored. Glad I don't pay anymore.

[quangv]

Please fix this, LastPass is quite popular, it shouldn't be causing angular/vue/react to not work! Those front-end frameworks are quite popular too.

fix for devs:
KillerCodeMonkey/ngx-quill#351 (comment)

[dslounge]

Wow, this is an annoying bug

[AdamLenda]

This issue appears to still be on going.

How is it that LastPass worked perfectly for 10+ years and now it is becoming a recurring problem for me?

[observaInc]

Any reason this hasn't been fixed in the year since it was reported? Too busy fixing security holes? Still happening on Chrome V. 76.0.3809.132 (Official Build) (64-bit)...

[robclancy]

Because they don't care. I have new bugs each update. Once I have time will move to one of the open source versions so I don't have to use workarounds just so I can develop with it enabled.

…

On Tue., 17 Sep. 2019, 12:22 observaInc, ***@***.***> wrote: Any reason this hasn't been fixed in the year since it was reported? Too busy fixing security holes? Still happening on Chrome V. 76.0.3809.132 (Official Build) (64-bit)... — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#428?email_source=notifications&email_token=AAGRIF5UTF2M7GHXFUI4UTLQKDY2DA5CNFSM4FNFOESKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6442JI#issuecomment-532270373>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAGRIF5Y27IKWYTWR3B3A2TQKDY2DANCNFSM4FNFOESA> .

[mshirlaw]

I've also run into th problem mentioned in this thread in chrome. (I realise this repo is not the chrome extention). Would be happy to help look into it but the actual repo is closed source as far as I can tell.

[dirq]

+1

[gdibble]

For users with corporate accounts and policies preventing plug-in disablement, this particularly stings.

[tfilo]

I have this issue in console:

Uncaught TypeError: Cannot read property 'type' of undefined
at setFieldValue (onloadwff.js:71)
at HTMLFormElement.formKeydownListener (onloadwff.js:71)

[Racso]

+1.

Thank you guys for this thread. You saved me from checking my JS code and libraries looking for the source of the error.

Also, thanks to @aarondevon for the workaround.

[kevinleedrum]

This seriously needs to be fixed.

[NBroomfield]

+1 it's a two minute fix, come on.

[robclancy]

I switched to bitwarden because of this issue and other bugs and I have to say it's just way better. Never gets in the way with UI over the top of inputs and doesn't have any bugs I have seen. Doesn't prompt to save as consistently but adding one manually is pretty fast anyway.

[NBroomfield]

I switched to bitwarden because of this issue and other bugs and I have to say it's just way better. Never gets in the way with UI over the top of inputs and doesn't have any bugs I have seen. Doesn't prompt to save as consistently but adding one manually is pretty fast anyway.

Thanks, might take a looks :-)

[briedis]

This is super annoying.

Developing a simple form, and when hitting an enter in an input, it just throws this error which gets caught in the debugger.

[robclancy]

No this is a grudge lmao. And I get notifications here. I and many people have them money and they couldn't add a simple if statement to fix a bug. Over years. Dogshit company.

…

On Fri, 4 Mar 2022, 05:58 Dai, ***@***.***> wrote: @robclancy <https://github.com/robclancy> I'll admit that I secretly suspect that you are still actually a fan of lastpass, but by publicly promoting lastpass' competitors in this thread it will hopefully make the lastpass team *finally* sit-up, take-notice, and fix this issue? And if not, maybe it is a good idea to switch... — Reply to this email directly, view it on GitHub <#428 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAGRIFYSCDL45IYSH6UXKA3U6EKWTANCNFSM4FNFOESA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[quantuminformation]

What country owns last past now?

[typehorror]

I've updated the code, the error appears with any <textarea /> contained in any <form />, turns out, there is no react or JS needed. I've been in touch with lastpass support they told me they are working on it. They requested me to follow a process to send them logs but I discovered hashes and keys in the logs and decided no to send them out of an abundance of caution (it felt super sketchy to me and still does)

[jzabroski]

They requested me to follow a process to send them logs but I discovered hashes and keys in the logs and decided no to send them out of an abundance of caution (it felt super sketchy to me and still does)

Are you saying that their log capture tool is logging your secrets? Where is this logged?

[typehorror]

@jzabroski The support person I've discussed with insisted that no login information was part of the logs, but I suspect they just don't know the details included in these logs. I'm attaching a screenshot of what is included in the logs generated by their "background" process, you can see different hashes included, I also found encryption keys in the response contained in the logs.

[daiplusplus]

@debrice I also found encryption keys in the response contained in the logs.

Uhhhh, that's very, very bad. Methinks you/us/someone should ask them directly about that: https://www.lastpass.com/security and let us know what they say

[typehorror]

Trust me I've tried to bring that to their attention and was repeatedly asked to still send the logs for my support request to be handled, even tho I've provided steps for reproduction, live example, videos and screenshots.

It is extremely frustrating

[typehorror]

I've initially provided the reproduction details in January 24th, received an email yesterday saying that the issue is still under investigation.

[marc-wilson]

I went through a similar process and had contact with LastPass. The excuse they gave me was this wasn't that big of an issue and they have better things to work on.

However, they did bring up one valid point. The repo that this issue is attached to is the lastpass-cli, not the extension. So this issue could likely be getting ignored because it's in the wrong place. The fact that someone from LastPass hasn't jumped in here and closed it out or moved it to the correct place where it could get attention is even more unfortunate.

The other thing is that this repo hasn't seen a commit since 2019. I'm guessing Lastpass has ditched GitHub and moved to something else.

[addliam]

If it works for anyone. I did what Chrome suggest for ignore a script. Details here: https://developer.chrome.com/docs/devtools/javascript/reference/#settings-ignore-list

1. Open Settings
2. Go to the Ignore List tab.
3. Click Add pattern.
   4 . Enter the this pattern: /onloadwff\.js$
   Click Add.

[robclancy]

1password is just way better btw

[pefferen]

Right-clicking the file and ignoring it from the debugger helped me in Firefox.

[typehorror]

@robclancy can you migrate your saved passwords from lastpass to 1passwords?

edit: I've just switch to Bitwarden, you can import all your passwords from lastpass (and others) easily, it's free and even better it's actually open source. They also have a premium plan which is only $10/year (I'll likely use it). So far no bugs in the console. It works on iOS, chromium, brave, chrome, firefox and safari <3

[VashJuan]

Alternate solution:
LastPass: Open Vault | Account Settings | Never URLs,
then add "localhost" & specify "Do Nothing"

[bonanzaeducation]

C'mon Lastpass programmers! This bug has been around for more than four years and you still haven't fixed it!? Please fix it, it's soon 2023 and it's extremely annoying trying to debug an Azure project locally and from time to time (actually whenever my local code exists and then the debugging session in chrome starts to debug your onloadwff.js as it run behind my code, and then) chrashes chrome debug! Also causes cpu 100% for a short period (1 min). What the f-k are you doin in your code!?

[bonanzaeducation]

If it works for anyone. I did what Chrome suggest for ignore a script. Details here: https://developer.chrome.com/docs/devtools/javascript/reference/#settings-ignore-list

1. Open Settings
2. Go to the Ignore List tab.
3. Click Add pattern.
   4 . Enter the this pattern: /onloadwff\.js$
   Click Add.

Nope, didn't fix it.

[bonanzaeducation]

Alternate solution: LastPass: Open Vault | Account Settings | Never URLs, then add "localhost" & specify "Do Nothing"

Nope, sorry. But that didn't fix it.

[moy2010]

It's 2023 now and the issue hasn't been fixed. Moving away from LastPass will fix it.

[Minho-Lee]

Issue still exists, was tearing my hair out until I figured out it was a LastPass issue...

[soniamontero]

Still awaiting for a fix.

[ER-95]

Unbelievably lazy that this has been ignored for nigh on 5 years.

[jzabroski]

For all we know, at this point, hackers breaching LastPass CI/CD environment may have been searching for that wonderous onloadwff.js file.

In the mean time, I may start selling tshirts that say "onloadwff.js" over and over and over all over the t shirt.

[MrPeteH]

However, they did bring up one valid point. The repo that this issue is attached to is the lastpass-cli, not the extension. So this issue could likely be getting ignored because it's in the wrong place. The fact that someone from LastPass hasn't jumped in here and closed it out or moved it to the correct place where it could get attention is even more unfortunate.

Wait. Doesn't this mean that the actual issue is right here in lastpass-cli, not lastpass itself? Can't we fix it here?

Or are you saying it simply needs to become a case on the LP support site?

[nullbio]

Sigh. Time to switch password managers. Lastpass really has become a joke.

[VashJuan]

BitWarden hasn't been an issue for me, in this regard - or any others! Recommended!

[pefferen]

Happily switched to Bitwarden too, unsubscribing here. 👋

[nullbio]

Can't go wrong with 1password either. Super easy to transition, should have done this sooner.

[robclancy]

lastpass is easily the worst option, basically any other option is better even stuff like apple passwords.