Through focussed debugging, I have discerned that if a web page's "text" input element's name attribute contains a dash (and does not contain -#- (e.g. -0-)), Safari will: Display a contacts icon inside the field and Add a drop-down populated with phone numbers from the user's contact card (on top of any pre-existing datalist dropdown). Ignore the element's autocomplete="off" There is post after post and blog article after blog article on the web that propose endless solutions to similar Safari issues, each working in various different contexts. It's a mess really. I am currently trying to develop a django web form for scientific data using django's FormSet class. Specifically, I was using FormsSet.empty_form to create a javascript clone-able form that would propagate field values to added (numbered) forms. I implemented things incrementally. I started out with a regular form and encountered a behavior where an autofill dropdown would present me with previously submitted values, e.g.: Adding autocomplete="off" to the input element prevented this. I then implemented formsets, defaulting to 1 form (so that all input elements' names started with form-0-) and everything worked as expected. However, when I changed the strategy with default to 0 initial forms and presented FormSet.empty_form as a template that would be cloned anytime files were dropped/selected, I started getting phone number drop-downs in all of the test fields: I googled this quite a bit and tried many things, including a strategy I'd employed before, to no avail, so to make debugging this issue easier and try a bunch of things quickly, I saved the page source and put it in the static folder, then started tweaking things to figure out what was causing this to happen. It appears that anytime a text input element's name attribute contains a dash (and does not contain -#-), Safari assumes it's a phone number field, despite the fact that the name's text, placeholder's text, possibly the label's text, the fact that the element has a list attribute set to the ID of a datalist element, and the fact that autocomplete is explicitly set to off. I would say that the heuristic used to trigger phone number autofill needs some serious tweaking. Not only that, but web developers need more transparency on how it works, so that non-sensical autofill behavior like this can be avoided. Another aspect of this is that if you have lots of cloned forms that Safari tries to apply autofill to, it dramatically decreases the page's performance. Safari autofill behavior has been a constant bane of mine, because many of our users use macs. I have not yet tried CSS solutions I've seen hints of (mainly because all the articles/posts I've seen about them are quite dated). Any information anyone can provide to tame Safari autofill and prevent this errant behavior would be much appreciated.

How can I trigger, or rather, when is the ASCredentialProviderViewController.prepareOneTimeCodeCredentialList(for:) method triggered? I can't seem to get it to work. I've added the ProvidesOneTimeCodes key to the Info.plist. I've added the com.apple.developer.authentication-services.autofill-credential-provider entitlement. Example of the extension: class CredentialProviderViewController: ASCredentialProviderViewController { override func prepareOneTimeCodeCredentialList(for serviceIdentifiers: [ASCredentialServiceIdentifier]) { print("********************************* prepareOneTimeCodeCredentialList \(serviceIdentifiers)") } override func prepareInterfaceForUserChoosingTextToInsert() { print("********************************* prepareInterfaceForUserChoosingTextToInsert") } } The app is enabled in the AUTOFILL FROM: in Settings App.

Topic description: when a user wants to create a new Account and ignores the "Use strong password" or "choose other option" and clicks on button to next screen, the app will hang. User Interaction / Experience A Screen with usernameInputField, a passwordInputField and a Button to create the account. The next screen will be pushed (not modally). The second screen allows some userinteraction (in the example counting upwards and displaying this, which allows checking if the app responds to input). How to reproduce The user types in a username and klicks on the passwordTextField. A strong password is suggested by Apple. The overlay shows at the bottom. We ignore the Buttons provided by the overlay and press on the button in the app to create the account. Transition to next page animates, but the next screen is unresponsive. Expected behavior (which works sometimes, when running with debugger) On the second screen the Do you want to store the password action sheet should be displayed (like in the screenshot). Findings This bug occures for our production App with UIKit and SwiftUI implementation. I could also find an App on the AppStore with the same Bug and similar patterns (usernameField + passwordField + nextButton + navigation by pushing the next viewController). I implemented the most basic to reproduce the bug and be sure it is nothing in my code. I cannot provide a standalone project, because https://<fully qualified domain>/.well-known/apple-app-site-association Information needs to be given for strong password to be suggested. Screenshots when not running into bug. // AppDelegate func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool { appWindow = UIWindow(frame: UIScreen.main.bounds) let viewController = UIHostingController(rootView: ContentView()) let navigationController = UINavigationController(rootViewController: viewController) appWindow.rootViewController = navigationController appWindow.makeKeyAndVisible() return true } // Create Account implementation struct CounterView: View { @State var counter = 0 var body: some View { VStack { Text(String(counter)) .font(.title) Button("+", action: { counter += 1 }) .buttonStyle(BorderedProminentButtonStyle()) } } } struct ContentView: View { @State var username = "" @State var password = "" var body: some View { VStack { Text("Choose your login credentials") .padding() TextField("username", text: $username) .textContentType(.username) SecureField("password", text: $password) .textContentType(.newPassword) NavigationLink(destination: CounterView()) { Text("create account") } } .padding(40) } } The bug does NOT occure when you have the debugger attached from the start. I was able to get the bug and then attach to the process. I could see that memory raised drastically and the app crashed after a long time. While testing, I could see once View <:0x0> does not conform to UITextInput protocol being printed to the console. The bug does not occure when you present the next screen modally. With Debugger attached the App response as expected and presents the action sheet for do you want to store the password. My guess I think when the transition to the next screen happens, the reference to some critical information for save password gets deallocated and then some Apple Api tries to show the action sheet but this does not work because some Information is missing. This seems to prevent the userinteraction and some code runs in an endless loop which would explain the memory raising quickly (our production build runs normally between 30 MB and 80 MB Memory). Does anyone have similar issues? I think all Ideas to fix this are some sort of hacks to make it work and I would think Apple needs to fix this, what do you think?

I recently released my first app. I noticed that on my login screen, the keyboard on both my email TextField and my password SecureField was showing an autofill for passwords. I was setting their keyboard type, but looking into this, I noticed that there is a text content type that I should also be setting. Upon setting this, nothing changed. The only thing that does seem to change this functionality is by hiding the SecureField. I ran into a problem when I tried adding a dismiss button to the toolbar of these keyboards. I was able to find people talking about this being an iOS 17 bug. However, I have not found anyone talking about this autofill issue. Is this also a bug in iOS 17? Back when I was creating the login page for my app, I believe it was still iOS 16, and that would explain why I didn't notice it before. One more note I just ran across while testing. If I add a second identical TextField, it won't have this autofill.

"ASCredentialProviderViewController" class was implemented in my password manager to autofill password for the app clients. I've added passkey support recently but biometric/code authentication is not asked by the system when the user tries to sign in with a passkey thanks to "provideCredentialWithoutUserInteraction(for credentialRequest: ASCredentialRequest)". For passwords: extensionContext.completeRequest(withSelectedCredential: ASPasswordCredential(), completionHandler: nil) -> Does trigger biometric/code authentication For passkeys: extensionContext.completeAssertionRequest(using: ASPasskeyAssertionCredential()) -> Does NOT trigger biometric/code authentication => Why authentication is managed by the system for password but not for passkeys ? And how to fix that?

It is clearly stated here that automatically created passwords are 20 characters long, contain 2 hyphens and exactly one uppercase letter and one digit. I have only ever seen generated passwords where the arrangement is in 3 groups of 6 (separated by the hyphens). From the description in the page referred to above, it could be that the generated password might look like: nzomZhf-qnbqd-k8ibtt i.e., a 7-5-6 pattern This would comply with the definition (if that's what it is) on the aforementioned Support page. Is it guaranteed that auto generated passwords will conform to the 3 groups of 6 pattern?

Hello forums, I have a problem with Autofill multiply SecureFields. I created a SwiftUI view with 2 SecureFields, createPassword and confirmPassword. Does not matter how I change the textContentType, AutoFill will only fill the first SecureField. For testing, I set the first SecureField textContentType to .none / .userName/ .email, and second SecureField sets to .newPassword, but AutoFill still fills password in first SecureField. As I know Apple advises to put both SecureField textContentType to .newPassword but it seems only working in UIKit: Enabling Password AutoFill on a text input view struct ContentView: View { @State private var createPassword = "" @State private var confirmPassword = "" var body: some View { VStack { SecureField("Password", text: $createPassword) .textContentType(.newPassword) SecureField("Password confirmation", text: $confirmPassword) .textContentType(.newPassword) } .padding() } } Thank you!

I want to add my testing app and prod app for release in associated domain file. How can I add them in apple-app-site-association. Can I add both separated by coma { "webcredentials": { "apps": [ "3ABCDEF.com.lalitha.release" , 3ABCDEF.com.lalitha.test] } } In Apple documentation example they haven't mention about adding multiple apps under web credentials [https://developer.apple.com/documentation/xcode/supporting-associated-domains]

Hello everyone, I am encountering an issue with the iOS Autofill framework where the app saves the password with only the main domain (company.com) instead of the full subdomain (xyz.company.com) that I have specified. Here are the details of my configuration: Entitlements.plist: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>com.apple.developer.associated-domains</key> <array> <string>applinks:xyz.company.com</string> <string>webcredentials:xyz.company.com</string> </array> <key>keychain-access-groups</key> <array> <string>$(AppIdentifierPrefix)com.company</string> </array> </dict> </plist> apple-app-site-association file: { "applinks": { "details": [ { "appIDs": ["ABCDEFGHIJ.com.company"] } ] }, "webcredentials": { "apps": ["ABCDEFGHIJ.com.company"] } } Issue Description: I have configured the Entitlements.plist and the apple-app-site-association file to use a subdomain (xyz.company.com). However, when the app saves the password, it only saves it under company.com rather than the full subdomain xyz.company.com. Steps Taken: Verified that the Entitlements.plist contains the correct entries for applinks and webcredentials. Checked the apple-app-site-association file to ensure it includes the correct app IDs and details. Confirmed that the subdomain xyz.company.com is correctly set up and accessible. Expected Behavior: The Autofill framework should save passwords with the full subdomain xyz.company.com as specified in the configuration. Actual Behavior: Passwords are being saved with only the main domain company.com, ignoring the specified subdomain. Questions: Is there a specific configuration or step that I might be missing to ensure that the Autofill framework recognizes the full subdomain? Are there any known issues or limitations with using subdomains in the applinks and webcredentials settings? Any insights or suggestions on how to resolve this issue would be greatly appreciated. Thank you in advance for your help! Best regards, Andy

I did implement "ASCredentialProviderViewController" class for my password manager in order to support passkey recently. Passkey registration and assertion works correctly but remote fullfilling is not working as expected. Use case: The user wants to sign in with passkey on some computer A QRCode is displayed and the user scan the QRCode Apple Authentication bottom sheet is opened and the client can pick my app as a provider ISSUE HERE: my app doesn't receive the passkey request parameters and is not able to generate the assertion answer I was hoping the following functions to be called but it's not the case: prepareCredentialList(for serviceIdentifiers: [ASCredentialServiceIdentifier], requestParameters: ASPasskeyCredentialRequestParameters) prepareInterfaceToProvideCredential(for credentialRequest: ASCredentialRequest) provideCredentialWithoutUserInteraction(for credentialRequest: ASCredentialRequest) => Please, how can my app receive the passkey request parameters in order to generate the assertion answer in this situation?

I've setup applinks for Universal Links purposes on my app. But I noticed that setting up applinks also sets up Password AutoFill. Upon logging in I don't want my users to be prompted to Save Password because of the way we use our subdomains. How can I disable Password AutoFill while retaining Universal Links capability, and without disabling secureTextEntry on my UITextField?

We are implementing a 3rd party Passkeys Manager app for ios. In the ios app in the CredentialProviderViewController I've implemented: func prepareCredentialList( for serviceIdentifiers: [ASCredentialServiceIdentifier] ) func provideCredentialWithoutUserInteraction( for credentialRequest: ASCredentialRequest ) func prepareInterfaceToProvideCredential( for credentialRequest: ASCredentialRequest ) func prepareInterface( forPasskeyRegistration registrationRequest: ASCredentialRequest ) When testing on webpages like webauthn.io and webauthn.me , our app shows up as one of the options for creating a passkey. We are getting the calls in prepareInterface() and handling it as advised here https://developer.apple.com/documentation/authenticationservices/ascredentialproviderviewcontroller/4172626-prepareinterface/ However the registration is failing. I understand that in this function, we need to create a passkey using a crypto library and then call completeRegistrationRequest(using:completionHandler:) The documentation on this is scant so it is hard to debug for this reason. Need help fixing this issue. What could we be missing? Is there any sample code for overriding these functions? Any recommendations on the crypto library for generating passkeys When the passkeys have been generated, how do we pass it back to the system? Thank you, Jaydip.

Hello everyone! In our application, we have login via phone number (with an SMS code as a password) and the ability to add a bank card to Apple Wallet. When logging in via phone number, upon receiving the SMS code, it automatically suggests filling in the input field. However, the field itself is not of type .oneTimePassword, and the SMS does not contain @domain, #code at the end (please look at the screenshot). So, when adding a card to Apple Wallet, PKAddPaymentPassViewController is launched, where entering the code from the SMS is also required to activate the card. However, no autocomplete prompt for the SMS password appears when displaying this field. Does anyone have information on why this is happening and how it can be implemented?

Any extension views called from ASCredentialProviderViewController -> open func prepareInterface(forPasskeyRegistration registrationRequest: ASCredentialRequest) cannot be accessed through Keyboard (Setting->Accessibility->Keyboards->Full Keyboard Access enabled). I have to manually type the prompted screen once to be able to get focused and continue to use Keyboard. Is it a known issue or I am missing anything? Please suggest. Thanks!

Hi, I'm trying to disable password autofill using textContentType = none but in iOS 17 it doesn't work when you have isSecureTextEntry = true I also have a question about how to disable password autofill so that it doesn't fill out the email field. i tried too with textContentType = none and nothing

I’m looking to see if anybody else has noticed that iOS 17.4 seems to have broken password autofill for associated domains. Meaning if I open my app to the login page (web view) it recognizes the associated domains and they password in my keychain. If I tap on my user name my keychain is unlocked with biometrics (FaceID) and I’m returned to the page, but the user name and password field is not filed in. This just started happening in iOS 17.4 (17.3.1 works fine for example). Interestingly, if you choose the 🔑 icon on the right side of the keyboard and then choose your credentials you get a blank page until you tap in a text field then the username and password show up. I have filled out a bug report with Apple, but in the mean time I was curious if anybody else has seen this or have a solution.

I have form fields in an app, I have some validations to perform like phone number should only have digits and not alphabets, however when user uses AutoFill option doing long press on textfield they have option to choose Contacts and they can tap on name and it will paste alphabets in my Phone number field, that behavior I don't want as my validations will not be fulfilled. There are no callbacks to detect and prevent that text from being pasted. In shouldChangeCharactersIn delegate method even if I return false for that paste event it ignores that and forcefully it gets pasted. Please help how to tackle such scenarios to perform above mentioned validations. Thanks

When a VC dissapears that contained a textfiled with: textField.textContentType = .password I get the dialog "Would you like to save the password to iCloud keychain". If I send the app to background without dismissing the dialog first, and I get the app to foreground again, the dialog is not there but when I press any textfield inside the app the keyboard wont raise. Seems to be an iOS 13+ issue. Any help?

I'm trying to implement an AutoFill extension for passkeys. I need the extension to communicate with the containing app even when the containing app is terminated. Is there any (and I mean ANY) way to do it? P.S. I already tried the MMWormhole package and also tried to write to a file from the extension using NSFileCoordinator and observe this file in the containing app using NSFilePresenter. Both only work when the containing app is already running.

If you have associated domains enabled, the autofill feature is used, and then you get a UIAlertController that asks you to save or update the password. The problem is that if the user puts applications in the background before tapping either the 'Update Password' or the 'Not Now' button, the keyboard for text fields is no longer shown after switching back to the foreground. I reproduced this in several apps, which seems like an iOS Bug. This appears to be an old issue as well (see https://stackoverflow.com/a/61165107/9435282)