Disabling Auto-Complete on ASP.NET Forms

Wednesday, February 23, 2005 1:50 PM Filed under:

General

Disabling Auto-Complete on ASP.NET Forms

Popular browsers, such as Internet Explorer and Firefox support something called Auto-Complete. You've seen this many times. You go to a online form and as you start to type in fields you get a drop-down showing values you've typed in that field before. This feature can be turned off, but it really is a useful feature and can save you a lot of typing when entering redundant values.

As a web developer, you have to be conscious of the fact that the user's browser will likely have auto-complete turned on and be responsible enough to act accordingly. If you have a form that where the user could possibly enter private or secure values you need to be mindful that if the user is on a public computer that these values will be cached by the browser and seen by other users of that computer. You are able to control if the browser uses AutoComplete for your form or for specific values with just a small & simple tweak.

To turn off auto-complete for your entire form, all you need to do is add an attribute to your form tag, like this:

<form id="Form1" method="post" runat="server" autocomplete="off">

Easy enough. Now you won't get the auto complete on any of the controls on the form, works for any browser that supports auto-complete. The HTML INPUT tags also support the use of autocomplete=off and since the <asp:TextBox />control renders as INPUT tags then you can use it to set it on a control by control basis. Just add it to the TextBox at design-time (but note that VS.NET will underline it with a squiggly saying that textbox does not have an attribute for autocomplete - but it will still work):

<asp:TextBox Runat="server" ID="Textbox1" autocomplete="off"></asp:TextBox>

or at runtime:

Textbox1.Attributes.Add("autocomplete", "off");

Comments

Jonathan Chan 5/26/2005 10:02 AM

Exactly what I was looking for - thanks a lot
Eve 8/24/2005 9:44 PM

Thanks! It helped me too, as the distance between the autocomplete box and the textbox was too big. I couldn't change that, so I needed to turn it off.
Syed Murtaza Hussain Rizvi 1/6/2006 1:07 AM

Very nice article... one thing i should mention here that if autocomplete feature is not turned off in a webpage then javascript will not run on some events like on change.So it is must be turned off on such pages performing some mathematical function or some string manipulation.
ismael 1/14/2006 10:58 AM

Yes, this is exactly what I needed!
Louise 3/9/2006 1:27 AM

Thanks!! i have been googling this problem for a while and your note about VS.net underlinign it really helped as well :)
quitchat 3/27/2006 12:32 AM

Very useful small Tip.Thank you.
Donna 5/2/2006 11:34 AM

I also spent allot of time googling to find the solution. I can't Thank You enough!
msn 5/23/2006 2:37 PM

Thank You for a very useful tip.
Happy Coding
Abu Mohammad Shoyeb 6/27/2006 8:39 PM

very much thanks for ur help
daralick 8/15/2006 7:47 AM

I had been playing in the asp:textbox autocomplete="none" which wasn't doing the trick. Thanks for sharing...
roopa 9/18/2006 6:41 AM

Hi

I am trying to enable autocomplete , when its off on IE .

Could u please help
abc 9/18/2006 6:43 AM

Hi

I am trying to enable autocomplete , when its off on IE .

Could u please help
Mahesh 10/19/2006 12:22 PM

Thanks for the artcle.
Adrian Stannard 10/24/2006 2:55 AM

autocomplete="off" doesn't appear to work with firefox!
Ryan Farley 10/24/2006 6:34 AM

Hi Adrian,

It works for me in Firefox.

-Ryan
Jeff 11/29/2006 7:36 AM

For the people trying to turn it on I would think you would realize that some people find it really irritating and that as a security hole should not be able to be turned on from the other side.
James 3/3/2007 7:07 PM

THANKS. I too have been googling all over for ways to prevent a credit card number from "replayed" on subsequent visits.
nak 3/24/2007 5:05 AM

autocomplete property not found for asp:TextBox
Ryan Farley 3/24/2007 7:00 AM

nak,

This is mentioned in the article. The TextBox control renders as a HTML INPUT element, and the autocomplete attribute is carried over to that.

From the article above:

"Now you won't get the auto complete on any of the controls on the form, works for any browser that supports auto-complete. The HTML INPUT tags also support the use of autocomplete=off and since the <asp:TextBox />control renders as INPUT tags then you can use it to set it on a control by control basis. Just add it to the TextBox at design-time (but note that VS.NET will underline it with a squiggly saying that textbox does not have an attribute for autocomplete - but it will still work)"

-Ryan
Ed DeGagne 4/20/2007 7:11 AM

What makes implementing autocomplete on a field by field basis even more frustrating is that if you use ASP.NET controls, you have the ability to set the AutoCompleteType to one of many possible values (an enumeration).

What happens in IE is that this is implemented by adding a vcard_name=[type] attribute behind the scenes (look at page source). There is even an enumeration for AutoCompleteType.Disabled, which adds the appropriate autocomplete="off" attribute for you.

Unfortunately, it only works in IE as it is not even output for any other browser.
Ed DeGagne 4/20/2007 10:48 AM

The culprit is that unless an actual form submit is fired, then IE will not save your autocomplete values. In my case, I am using linkbuttons and they do not fire a form submit.

A fix is to override the __doPostback javascript function to get autosave values to save.

Ex:

var theform;
if (window.navigator.appName.toLowerCase().indexOf("netscape") > -1) {
theform = document.forms["Form1"];
}
else {
theform = document.Form1;
}

// Override the base __doPostBack function
var orig_doPostBack = __doPostBack;

function pd_PostBack(Param1, Param2)
{
// If IE, we need to explicitly run AutoComplete
// so form values are remembered.
if (document.all)
{
window.external.AutoCompleteSaveForm(theform);
}

// Set back to original __doPostBack.
__doPostBack = orig_doPostBack;
__doPostBack(Param1, Param2);
}
__doPostBack = pd_PostBack;

I also had another jscript function that needed to be overidden as well:

// Override the base WebForm_DoPostBackWithOptions function.
var orig_WebForm_DoPostBackWithOptions = WebForm_DoPostBackWithOptions;

function pd_DoPostBackWithOptions(options)
{
// If IE, we need to explicitly run AutoComplete
// so form values are remembered.
if (document.all)
{
window.external.AutoCompleteSaveForm(theform);
}

// Set back to original WebForm_DoPostBackWithOptions.
WebForm_DoPostBackWithOptions = orig_WebForm_DoPostBackWithOptions;
WebForm_DoPostBackWithOptions(options);
}
WebForm_DoPostBackWithOptions = pd_DoPostBackWithOptions;

This solver the issue for me and was based (and tweaked for my instance) from a MSDN article highlighting the fact that the autosave values are only saved on a submit form.

Folks, this is an IE only issue.
Tom 5/2/2007 8:10 PM

> AutoCompleteType.Disabled, which adds the appropriate
> autocomplete="off" attribute for you
>
> Unfortunately, it only works in IE as it is not even
> output for any other browser.

Thanks for confirming this for me. Driving me nuts figuring out why "AutoCompleteType = Disabled" wasn't working in Firefox.

However, hard coding AutoComplete = "off" works great!
David M. 6/4/2007 2:02 PM

Thnaks!
David Homer 11/30/2007 12:36 AM

Neat!

Thanks, like Tom I was expecting that in the code behind the oTextBox.AutoCompleteType=AutoCompleteType.None would actually work in IE :) obviously not
Peter 6/19/2008 6:03 AM

This works great. It's a pity it breaks XHTML validation though...
Dhiraj Kumar Singh 7/31/2008 10:50 AM

This Solution is very Good and I suggest to use this Solution if u want such type of facility
Matthew Trujillo 9/9/2008 1:29 PM

I found a simple solution for this. Instead of adding an attribute to each field, you can add it to the form.

Form.Attributes.Add("autocomplete", "off")

Just wanted to make sure this was simple for even the novices to understand.
Boleslav 9/27/2008 2:39 PM

Thanks! Greate solution for fixing LinkButtons postbacks in ASP.NET. Brilliant catch!
Arthur 10/2/2008 1:29 PM

Thank you! :)