Bug 281058 – Mobile browser applies Smart Punctuation to password field

• Component: Forms
• Status: RESOLVED INVALID

[Harold Liss]

Created attachment 472858 [details]
Screenshot of curly apostrophe in password field in ASWebAuthenticationSession

We're experiencing some user reports of being unable to sign in on mobile devices only, both iOS (in an ASWebAuthenticationSession) and Android browsers. Desktop browser login will succeed for impacted users. Our hypothesis, and one we've reproduced, is that the mobile browsers are applying Smart Punctuation to apostrophes in password fields, that is, changing "'" to "’", causing the password not to validate. It's not clear to us whether this has worked in the past. User reports of not being able to sign in on mobile apps but desktop working started probably midsummer 2024. It’s only a hypothesis that the users' passwords use Smart Punctuation eligible characters.

Password field tag with attributes on the impacted page: <input type="password" name="password" id="password" autocapitalize="none" autocorrect="off" placeholder="Password" autocomplete="current-password" required>

Note: This looks similar to https://stackoverflow.com/questions/48678359/ios-11-safari-html-disable-smart-punctuation.

[Harold Liss]

Upon further investigation: this appears to occur only when typed as the password field is toggled to visible. 

I no longer believe this is a webkit bug. Marking invalid.