Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Firefox autofills password into authorization token field, resulting in Error 401 #630

Open
4 tasks done
false-fox opened this issue May 22, 2024 · 3 comments · May be fixed by #631
Open
4 tasks done

Firefox autofills password into authorization token field, resulting in Error 401 #630

false-fox opened this issue May 22, 2024 · 3 comments · May be fixed by #631

Comments

@false-fox
Copy link

false-fox commented May 22, 2024

Undiscord Version

5.2.3

Browser

Firefox 126

Extension

Greasemonkey

Reproduction steps

  1. Have a username/password saved on discord.com in the built-in password manager
  2. Use undiscord as usual

Actual results

Password manager will silently and automatically fill the authorization token slot with the password, resulting in an error 401 as it's obviously not a token. Even after attempting to fix the issue by entering the correct token, it results in undefined behavior afterwards. (in one instance, it error 400s no matter what until I restart the browser, and set the delay intervals to null.)

Expected results

Firefox shouldn't fill it in, it should ignore it.

Bug affects

  • DMs
  • DMs (group)
  • Channels
  • Channel (NSFW)

Additional information & file uploads

To emphasize, this happens silently and automatically.
Screenshot_2024-05-21_172910
Screenshot_2024-05-21_173103
Screenshot_2024-05-21_172919

Proposed fix

Find an alternative to the "password" type for the token input html element, or provide more "no-autofill" signals, so password managers don't recognize it, or add a "lock" of sorts.

@false-fox
Copy link
Author

Possible cause for a lot of other error 401 issues

@false-fox
Copy link
Author

false-fox commented May 22, 2024

Possibly could use an input text element and use the webkit-text-security property. Experimental, but compatible with most browsers.

https://developer.mozilla.org/en-US/docs/Web/CSS/-webkit-text-security

@false-fox false-fox linked a pull request May 22, 2024 that will close this issue
@false-fox
Copy link
Author

Fixed in #631

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant