From f359d631d7259db7833b512bce219aa9a9f87317 Mon Sep 17 00:00:00 2001
From: Estelle Weyl <estelle@weyl.org>
Date: Sat, 23 Mar 2024 05:54:12 -0700
Subject: [PATCH] Autocomplete: add section-* (#32789)

* Autocomplete: add section-*

* edits
---
 .../web/html/attributes/autocomplete/index.md | 262 ++++++++++--------
 1 file changed, 143 insertions(+), 119 deletions(-)

diff --git a/files/en-us/web/html/attributes/autocomplete/index.md b/files/en-us/web/html/attributes/autocomplete/index.md
index d81e8cd536c44be..12fb919a94e33df 100644
--- a/files/en-us/web/html/attributes/autocomplete/index.md
+++ b/files/en-us/web/html/attributes/autocomplete/index.md
@@ -11,141 +11,165 @@ The HTML `autocomplete` attribute lets web developers specify what if any permis
 
 It is available on {{HTMLElement("input")}} elements that take a text or numeric value as input, {{HTMLElement("textarea")}} elements, {{HTMLElement("select")}} elements, and {{HTMLElement("form")}} elements.
 
-The source of the suggested values is generally up to the browser; typically values come from past values entered by the user, but they may also come from pre-configured values. For instance, a browser might let the user save their name, address, phone number, and email addresses for autocomplete purposes. Perhaps the browser offers the ability to save encrypted credit card information, for autocompletion following an authentication procedure.
+{{EmbedInteractiveExample("pages/tabbed/attribute-autocomplete.html", "tabbed-shorter")}}
+
+## Description
+
+The `autocomplete` attribute provides a hint to the user agent specifying how to, or indeed whether to, prefill a form control. The attribute value is either the keyword `off` or `on`, or a space-separated list of tokens.
 
-If an {{HTMLElement("input")}}, {{HTMLElement("select")}} or {{HTMLElement("textarea")}} element has no `autocomplete` attribute, then browsers use the `autocomplete` attribute of the element's form owner, which is either the {{HTMLElement("form")}} element that the element is a descendant of, or the `<form>` whose `id` is specified by the [`form`](/en-US/docs/Web/HTML/Element/input#form) attribute of the element (see the `<form>` [`autocomplete`](/en-US/docs/Web/HTML/Element/form#autocomplete) attribute).
+If an {{HTMLElement("input")}}, {{HTMLElement("select")}} or {{HTMLElement("textarea")}} element has no `autocomplete` attribute, the browser will use the [`autocomplete` attribute of the element's **owning form**](/en-US/docs/Web/HTML/Element/form#autocomplete). The owning form is either the {{HTMLElement("form")}} matching the `id` specified by the [`form`](/en-US/docs/Web/HTML/Element/input#form) attribute of the element (if present) or, more commonly, the `<form>` the element is nested in.
 
 > **Note:** In order to provide autocompletion, user-agents might require `<input>`/`<select>`/`<textarea>` elements to:
 >
 > 1. Have a `name` and/or `id` attribute
 > 2. Be descendants of a `<form>` element
-> 3. The form to have a {{HTMLElement("input/submit", "submit")}} button
+> 3. Be owned by a form with a {{HTMLElement("input/submit", "submit")}} button
 
-{{EmbedInteractiveExample("pages/tabbed/attribute-autocomplete.html", "tabbed-shorter")}}
+If the same list of tokens is used in more than one form control, the user-agent will autocomplete all occurrences of the same `autocomplete` value with the same data value.
+
+Some tokens may be used more than once with potentially different expected values, such as the `zip-code` token in a form that contains both shipping and billing addresses. Including multiple different tokens in a space-separated list causes the associated form controls to be given unique autocomplete values: in this case, `autocomplete="shipping zip-code"` and `autocomplete="billing zip-code"`.
+
+Some autocomplete values may need to be re-used multiple times. For example, a form may contain multiple shipping addresses and therefore multiple occurrences of `"shipping zip-code"` while still expecting different values. To make the autocomplete value unique in these cases, the first token in the space-separated list of tokens can be a `section-*` token, where the token's first eight characters are always the string "section-", followed by an alphanumeric string. All form fields given the `section-*` token with the same alphanumeric string belong to the same **named group**.
+
+If including the `autocomplete` attribute on {{HTMLElement("input/hidden", "hidden")}} input elements (`<input type="hidden">`), its value must be an ordered list of space-separated tokens; the `on` and `off` keywords are not allowed.
+
+The source of the suggested values is generally up to the browser; typically values come from past values entered by the user, but they may also come from pre-configured values. For instance, a browser might let the user save their name, address, phone number, and email addresses for autocomplete purposes. The browser may also offer the ability to save encrypted credit card information, for autocompletion following an authentication procedure.
 
 ## Values
 
-- "`off`"
+The attribute value is either the keyword `off` or `on`, or a space-separated `<token-list>` that describes the meaning of the autocompletion value.
+
+- `off`
 
   - : The browser is not permitted to automatically enter or select a value for this field. It is possible that the document or application provides its own autocomplete feature, or that security concerns require that the field's value not be automatically entered.
 
     > **Note:** In most modern browsers, setting `autocomplete` to "`off`" will not prevent a password manager from asking the user if they would like to save username and password information, or from automatically filling in those values in a site's login form. See [the autocomplete attribute and login fields](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields).
 
-- "`on`"
+- `on`
+
   - : The browser is allowed to automatically complete the input. No guidance is provided as to the type of data expected in the field, so the browser may use its own judgement.
-- "`name`"
-
-  - : The field expects the value to be a person's full name. Using "`name`" rather than breaking the name down into its components is generally preferred because it avoids dealing with the wide diversity of human names and how they are structured; however, you can use the following `autocomplete` values if you do need to break the name down into its components:
-
-    - "`honorific-prefix`"
-      - : The prefix or title, such as "Mrs.", "Mr.", "Miss", "Ms.", "Dr.", or "Mlle.".
-    - "`given-name`"
-      - : The given (or "first") name.
-    - "`additional-name`"
-      - : The middle name.
-    - "`family-name`"
-      - : The family (or "last") name.
-    - "`honorific-suffix`"
-      - : The suffix, such as "Jr.", "B.Sc.", "PhD.", "MBASW", or "IV".
-    - "`nickname`"
-      - : A nickname or handle.
-
-- "`email`"
-  - : An email address.
-- "`username`"
-  - : A username or account name.
-- "`new-password`"
-  - : A new password. When creating a new account or changing passwords, this should be used for an "Enter your new password" or "Confirm new password" field, as opposed to a general "Enter your current password" field that might be present. This may be used by the browser both to avoid accidentally filling in an existing password and to offer assistance in creating a secure password (see also [Preventing autofilling with autocomplete="new-password"](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#preventing_autofilling_with_autocompletenew-password)).
-- "`current-password`"
-  - : The user's current password.
-- "`one-time-code`"
-  - : A one-time password (OTP) for verifying user identity that is used as an additional factor in a sign-in flow.
-    Most commonly this is a code received via some out-of-channel mechanism, such as SMS, email, or authenticator application.
-- "`organization-title`"
-  - : A job title, or the title a person has within an organization, such as "Senior Technical Writer", "President", or "Assistant Troop Leader".
-- "`organization`"
-  - : A company or organization name, such as "Acme Widget Company" or "Girl Scouts of America".
-- "`street-address`"
-  - : A street address. This can be multiple lines of text, and should fully identify the location of the address within its second administrative level (typically a city or town), but should not include the city name, ZIP or postal code, or country name.
-    - "`shipping`"
-      - : The street address to send the product. This can be combined with other tokens, such as "`shipping street-address`" and "`shipping address-level2`".
-    - "`billing`"
-      - : The street address to associate with the form of payment used. This can be combined with other tokens, such as "`billing street-address`" and "`billing address-level2`".
-- "`address-line1`", "`address-line2`", "`address-line3`"
-  - : Each individual line of the street address. These should only be present if the "`street-address`" is not present.
-- "`address-level4`"
-  - : The finest-grained [administrative level](#administrative_levels_in_addresses), in addresses which have four levels.
-- "`address-level3`"
-  - : The third [administrative level](#administrative_levels_in_addresses), in addresses with at least three administrative levels.
-- "`address-level2`"
-  - : The second [administrative level](#administrative_levels_in_addresses), in addresses with at least two of them. In countries with two administrative levels, this would typically be the city, town, village, or other locality in which the address is located.
-- "`address-level1`"
-  - : The first [administrative level](#administrative_levels_in_addresses) in the address. This is typically the province in which the address is located. In the United States, this would be the state. In Switzerland, the canton. In the United Kingdom, the post town.
-- "`country`"
-  - : A country or territory code.
-- "`country-name`"
-  - : A country or territory name.
-- "`postal-code`"
-  - : A postal code (in the United States, this is the ZIP code).
-- "`cc-name`"
-  - : The full name as printed on or associated with a payment instrument such as a credit card. Using a full name field is preferred, typically, over breaking the name into pieces.
-- "`cc-given-name`"
-  - : A given (first) name as given on a payment instrument like a credit card.
-- "`cc-additional-name`"
-  - : A middle name as given on a payment instrument or credit card.
-- "`cc-family-name`"
-  - : A family name, as given on a credit card.
-- "`cc-number`"
-  - : A credit card number or other number identifying a payment method, such as an account number.
-- "`cc-exp`"
-  - : A payment method expiration date, typically in the form "MM/YY" or "MM/YYYY".
-- "`cc-exp-month`"
-  - : The month in which the payment method expires.
-- "`cc-exp-year`"
-  - : The year in which the payment method expires.
-- "`cc-csc`"
-  - : The security code for the payment instrument; on credit cards, this is the 3-digit verification number on the back of the card.
-- "`cc-type`"
-  - : The type of payment instrument (such as "Visa" or "Master Card").
-- "`transaction-currency`"
-  - : The currency in which the transaction is to take place.
-- "`transaction-amount`"
-  - : The amount, given in the currency specified by "`transaction-currency`", of the transaction, for a payment form.
-- "`language`"
-  - : A preferred language, given as a valid [BCP 47 language tag](https://en.wikipedia.org/wiki/IETF_language_tag).
-- "`bday`"
-  - : A birth date, as a full date.
-- "`bday-day`"
-  - : The day of the month of a birth date.
-- "`bday-month`"
-  - : The month of the year of a birth date.
-- "`bday-year`"
-  - : The year of a birth date.
-- "`sex`"
-  - : A gender identity (such as "Female", "Fa'afafine", "Hijra", "Male", "Nonbinary"), as freeform text without newlines.
-- "`tel`"
-
-  - : A full telephone number, including the country code. If you need to break the phone number up into its components, you can use these values for those fields:
-
-    - "`tel-country-code`"
-      - : The country code, such as "1" for the United States, Canada, and other areas in North America and parts of the Caribbean.
-    - "`tel-national`"
-      - : The entire phone number without the country code component, including a country-internal prefix. For the phone number "1-855-555-6502", this field's value would be "855-555-6502".
-    - "`tel-area-code`"
-      - : The area code, with any country-internal prefix applied if appropriate.
-    - "`tel-local`"
-      - : The phone number without the country or area code. This can be split further into two parts, for phone numbers which have an exchange number and then a number within the exchange. For the phone number "555-6502", use "`tel-local-prefix`" for "555" and "`tel-local-suffix`" for "6502".
-
-- "`tel-extension`"
-  - : A telephone extension code within the phone number, such as a room or suite number in a hotel or an office extension in a company.
-- "`impp`"
-  - : A URL for an instant messaging protocol endpoint, such as "xmpp:username\@example.net".
-- "`url`"
-  - : A URL, such as a home page or company website address as appropriate given the context of the other fields in the form.
-- "`photo`"
-  - : The URL of an image representing the person, company, or contact information given in the other fields in the form.
-- "`webauthn`"
-  - : Passkeys generated by the [Web Authentication API](/en-US/docs/Web/API/Web_Authentication_API), as requested by a conditional {{domxref("CredentialsContainer.get()", "navigator.credentials.get()")}} call (i.e., one that includes `mediation: 'conditional'`). See [Sign in with a passkey through form autofill](https://web.dev/articles/passkey-form-autofill) for more details.
+
+- `<token-list>`
+
+  - : An ordered set of space-separated tokens consisting of autofill detail tokens. The detail tokens include:
+
+    - "`section-*`"
+
+      - : Defines the name for a group of form controls. A token whose first eight characters are the string "section-", case-insensitive, followed by additional characters. If present, this token must be the first token in the space-separated list of tokens. All form controls that start with the same token belong to the named group.
+
+    - "`name`"
+
+      - : The field expects the value to be a person's full name. Using "`name`" rather than breaking the name down into its components is generally preferred because it avoids dealing with the wide diversity of human names and how they are structured; however, you can use the following `autocomplete` values if you do need to break the name down into its components:
+
+        - "`honorific-prefix`"
+          - : The prefix or title, such as "Mrs.", "Mr.", "Miss", "Ms.", "Dr.", or "Mlle.".
+        - "`given-name`"
+          - : The given (or "first") name.
+        - "`additional-name`"
+          - : The middle name.
+        - "`family-name`"
+          - : The family (or "last") name.
+        - "`honorific-suffix`"
+          - : The suffix, such as "Jr.", "B.Sc.", "PhD.", "MBASW", or "IV".
+        - "`nickname`"
+          - : A nickname or handle.
+
+    - "`email`"
+      - : An email address.
+    - "`username`"
+      - : A username or account name.
+    - "`new-password`"
+      - : A new password. When creating a new account or changing passwords, this should be used for an "Enter your new password" or "Confirm new password" field, as opposed to a general "Enter your current password" field that might be present. This may be used by the browser both to avoid accidentally filling in an existing password and to offer assistance in creating a secure password (see also [Preventing autofilling with autocomplete="new-password"](/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#preventing_autofilling_with_autocompletenew-password)).
+    - "`current-password`"
+      - : The user's current password.
+    - "`one-time-code`"
+      - : A one-time password (OTP) for verifying user identity that is used as an additional factor in a sign-in flow.
+        Most commonly this is a code received via some out-of-channel mechanism, such as SMS, email, or authenticator application.
+    - "`organization-title`"
+      - : A job title, or the title a person has within an organization, such as "Senior Technical Writer", "President", or "Assistant Troop Leader".
+    - "`organization`"
+      - : A company or organization name, such as "Acme Widget Company" or "Girl Scouts of America".
+    - "`street-address`"
+      - : A street address. This can be multiple lines of text, and should fully identify the location of the address within its second administrative level (typically a city or town), but should not include the city name, ZIP or postal code, or country name.
+        - "`shipping`"
+          - : The street address to send the product. This can be combined with other tokens, such as "`shipping street-address`" and "`shipping address-level2`".
+        - "`billing`"
+          - : The street address to associate with the form of payment used. This can be combined with other tokens, such as "`billing street-address`" and "`billing address-level2`".
+    - "`address-line1`", "`address-line2`", "`address-line3`"
+      - : Each individual line of the street address. These should only be present if the "`street-address`" is not present.
+    - "`address-level4`"
+      - : The finest-grained [administrative level](#administrative_levels_in_addresses), in addresses which have four levels.
+    - "`address-level3`"
+      - : The third [administrative level](#administrative_levels_in_addresses), in addresses with at least three administrative levels.
+    - "`address-level2`"
+      - : The second [administrative level](#administrative_levels_in_addresses), in addresses with at least two of them. In countries with two administrative levels, this would typically be the city, town, village, or other locality in which the address is located.
+    - "`address-level1`"
+      - : The first [administrative level](#administrative_levels_in_addresses) in the address. This is typically the province in which the address is located. In the United States, this would be the state. In Switzerland, the canton. In the United Kingdom, the post town.
+    - "`country`"
+      - : A country or territory code.
+    - "`country-name`"
+      - : A country or territory name.
+    - "`postal-code`"
+      - : A postal code (in the United States, this is the ZIP code).
+    - "`cc-name`"
+      - : The full name as printed on or associated with a payment instrument such as a credit card. Using a full name field is preferred, typically, over breaking the name into pieces.
+    - "`cc-given-name`"
+      - : A given (first) name as given on a payment instrument like a credit card.
+    - "`cc-additional-name`"
+      - : A middle name as given on a payment instrument or credit card.
+    - "`cc-family-name`"
+      - : A family name, as given on a credit card.
+    - "`cc-number`"
+      - : A credit card number or other number identifying a payment method, such as an account number.
+    - "`cc-exp`"
+      - : A payment method expiration date, typically in the form "MM/YY" or "MM/YYYY".
+    - "`cc-exp-month`"
+      - : The month in which the payment method expires.
+    - "`cc-exp-year`"
+      - : The year in which the payment method expires.
+    - "`cc-csc`"
+      - : The security code for the payment instrument; on credit cards, this is the 3-digit verification number on the back of the card.
+    - "`cc-type`"
+      - : The type of payment instrument (such as "Visa" or "Master Card").
+    - "`transaction-currency`"
+      - : The currency in which the transaction is to take place.
+    - "`transaction-amount`"
+      - : The amount, given in the currency specified by "`transaction-currency`", of the transaction, for a payment form.
+    - "`language`"
+      - : A preferred language, given as a valid [BCP 47 language tag](https://en.wikipedia.org/wiki/IETF_language_tag).
+    - "`bday`"
+      - : A birth date, as a full date.
+    - "`bday-day`"
+      - : The day of the month of a birth date.
+    - "`bday-month`"
+      - : The month of the year of a birth date.
+    - "`bday-year`"
+      - : The year of a birth date.
+    - "`sex`"
+      - : A gender identity (such as "Female", "Fa'afafine", "Hijra", "Male", "Nonbinary"), as freeform text without newlines.
+    - "`tel`"
+
+      - : A full telephone number, including the country code. If you need to break the phone number up into its components, you can use these values for those fields:
+
+        - "`tel-country-code`"
+          - : The country code, such as "1" for the United States, Canada, and other areas in North America and parts of the Caribbean.
+        - "`tel-national`"
+          - : The entire phone number without the country code component, including a country-internal prefix. For the phone number "1-855-555-6502", this field's value would be "855-555-6502".
+        - "`tel-area-code`"
+          - : The area code, with any country-internal prefix applied if appropriate.
+        - "`tel-local`"
+          - : The phone number without the country or area code. This can be split further into two parts, for phone numbers which have an exchange number and then a number within the exchange. For the phone number "555-6502", use "`tel-local-prefix`" for "555" and "`tel-local-suffix`" for "6502".
+
+    - "`tel-extension`"
+      - : A telephone extension code within the phone number, such as a room or suite number in a hotel or an office extension in a company.
+    - "`impp`"
+      - : A URL for an instant messaging protocol endpoint, such as "xmpp:username\@example.net".
+    - "`url`"
+      - : A URL, such as a home page or company website address as appropriate given the context of the other fields in the form.
+    - "`photo`"
+      - : The URL of an image representing the person, company, or contact information given in the other fields in the form.
+    - "`webauthn`"
+      - : Passkeys generated by the [Web Authentication API](/en-US/docs/Web/API/Web_Authentication_API), as requested by a conditional {{domxref("CredentialsContainer.get()", "navigator.credentials.get()")}} call (i.e., one that includes `mediation: 'conditional'`). See [Sign in with a passkey through form autofill](https://web.dev/articles/passkey-form-autofill) for more details.
 
 See the [WHATWG Standard](https://html.spec.whatwg.org/multipage/forms.html#autofill) for more detailed information.