Chrome & Edge - Stop remembering fields

[CHiLL]

We have Sophos as our filtering, with YouTube set as blocked by default for students - except if they use a bypass code. With the bypass option enabled, when a student accesses YouTube, they get the block page and also an extra field where they can enter the bypass code to temporarily access YouTube. We have generated codes for each department and the staff must fill the code in themselves and not let the students know what it is (which isn't always the case). However, we have noticed that the browsers (Chrome and Edge, both latest versions) will remember that code after it's been entered. This means that the next time that student logs onto that same computer (or in the case of Edge and synced Microsoft settings, everywhere)...when they get to the YouTube block page and click the bypass field, both browsers will show the code as an autofill field. This is despite we have specifically disabled all autofill, password remembering, etc features in both browsers via GPO. Does anyone know which setting (if there is one) that I can configure to prevent this from happening? Edited May 10, 2024 by CHiLL

[mavhc]

The code in the block page is wrong should have autocomplete="off" for the fields/forms

 

https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

[CHiLL]

The code in the block page is wrong should have autocomplete="off" for the fields/forms

 

https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion

Thanks for that, though that article seems to say that browsers ignore autocomplete="off" and may adhere to autocomplete="new-password", though it's not a standard that browsers must adhere to, so may not work.

 

Since that's an article for Firefox, I need to figure out where or if I can specify that for Chrome and Edge, as it appears that the only options I have are "Not configured", "Enabled" and "Disabled".

[mavhc]

https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete#browser_compatibility yeah, click the * for chrome, links to https://issues.chromium.org/issues/41239842

 

Looks like autocomplete="new-password" might work

[CHiLL]

https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete#browser_compatibility yeah, click the * for chrome, links to https://issues.chromium.org/issues/41239842

 

Looks like autocomplete="new-password" might work

Looks like this bug report dates back to 2015, so it may not be possible if the "off" flag isn't respected. I'm not finding a way to specify autocomplete="new-password", it certainly can't be done via the ADMX policies. Looking at chrome://flags and edge://flags, "autocomplete" isn't a valid flag that an be amended. In Firefox, it looks like you need to go into about:config, find the setting, change it from "Boolean" to "String" and then specify "new-password" as the value.

[mavhc]

You need to alter the block page html itself, or get Sophos to fix the bug

[CHiLL]

You need to alter the block page html itself, or get Sophos to fix the bug

Oh I see, I didn't understand that's what you meant in your original post. I'll raise that with Wave9 and see if they can raise it as a bug request with Sophos.