• GlitterInfection@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    7 months ago

    Display one form field at a time for an economical layout

    Preferably not when asking for username and password, since that messes with password manager autofill.

    • jadero@programming.dev
      link
      fedilink
      arrow-up
      1
      ·
      7 months ago

      And yet more sites do it, even on desktop. As far as I can tell, most of them are also doing it in a way that breaks security by validating the username before asking for the password.

      • Ephera@lemmy.ml
        link
        fedilink
        arrow-up
        1
        ·
        7 months ago

        I know that single sign-on can be integrated that way.

        For example, let’s say you work at Wheezecakes Inc. and want to log into your programming.dev account. Then you’d type your e-mail address, jadero@wheezecakes.com, into the username field and hit enter.

        The webpage sends that to the server, which realizes that you’re a Wheezecakes employee, so it redirects you to login.wheezecakes.com or whatever SSO provider is in use, you log in there (or ideally already have a login cookie), and then programming.dev just gets told that, yeah, you’re authenticated to login.

        So, while it’s obviously possible that webpages genuinely do this wrong, you’re probably seeing such SSO integration and they’re not actually validating the username ahead of time.