Bug 210061 – Password manager malfunction when returning to "add to homescreen" web app

• Status: NEW
• Component: Forms

[Ferdy Christant]

Created attachment 395592 [details]
password manager

This bug is a bit tricky to reproduce and my URL is not public. I realize this is less than useful, but I still want to share the feedback. I'm convinced the issue is unrelated to my particular web app, instead a browser bug.

Situation: 

I'm building a (server-rendered) web app that can be added to the homescreen. It has a manifest, simple pass-through service worker, iOS optimized icons, etc. The app includes a login page. The login page is a simple HTML form consisting of 2 field (email and password) and a submit button. The email and password fields are marked as type email, password respectively and I'm following the autofill best practices to make the form work well with password management solutions. There is no JS involved in this form, for now.

Generally, this works fine. For example, when focusing on the password field, mobile Safari either suggests to generate a new password or to log in using a saved account, if any. 

The particular issue only occurs for the web app when added to the homescreen, and when returning to it via task management after a while. 

Please see attached screenshot. The screenshot shows Safari password management offering login options from saved accounts. Normally, when tapping such an account, it triggers Face ID. After authentication, it populates the form. 

This functionality is sometimes completely broken. Two issues I've seen:
- The saved account entries being there yet when tapping them, nothing happens
- The space for the saved accounts is there, yet the text is empty. There's nothing to select

As mentioned, this only happens when returning to the homescreen app (whilst it was open in the background). The tricky part is that it happens sometimes. Typically some time has to pass. When switching out of the app and back immediately, I cannot reproduce it. At least some hours have to pass, it seems. Yet if I wait long enough, it pretty much always seem to happen. 

It seems the password manager gets into some corrupt state after a while, yet only for homescreen apps.

[Ferdy Christant]

Created attachment 395594 [details]
form

Since I don't have a URL, please find attached the markup fragment of my form. Also, I'm using...

<meta name="apple-mobile-web-app-capable" content="yes">

...on the login page, not sure if this is relevant.

[Radar WebKit Bug Importer]

<rdar://problem/61402987>