Autofill user name and password

[ejstefl]

Hello,

I have a situation where I have to share user names and passwords for a list of sites among several (30 or so) users. These passwords must be reset every 90 days and anytime any one of the users is no longer employed by us. As you can imagine, the user will get locked frequently due to people not paying attention to when a password changes.

I want to create a web site that has a link to each site that when clicked will take you to the site and auto fill the user name and password.

I am attempting to do this using bookmarklets. This is what I have so far:

javascript:window.location.href ="http://www.mysite.com";
checkLoad();

function checkLoad()
{
if (window.onLoad)
{document.forms[0].elements["oper"].value ='Eric';document.forms[0].elements["pswd"].value = 'secret';} 
else {setTimeout('checkLoad()',1000);}}

Obviously, I replaced mysite.com with the site I was trying to log into.

I know the second bit works (the document.forms. .. part) because if I navigate to the page and then execute it, it will fill in the fields. However, when I run it as is, it takes me to the page but does not fill in the fields.

The function checkLoad is supposed to check if the page is loaded and fill in the fields when it is, but it isn't working. Any suggestions or alternative approaches would be very welcome

[Dormilich]

postpone the call until the page finished loading, meaning use the onload event.

window.onload = function() {
    // execute code here
}
// or
window.onload = fn_call;

[ejstefl]

I tried this:

javascript:window.location.href ="https://www.mysite.com";window.onload = document.forms[0].elements["oper"].value ='Eric';document.forms[0].elements["pswd"].value = 'secret';

No luck, it navigates to the page but does not fill out the fields. Any ideas as to why not?

[Dormilich]

Any ideas as to why not?

sure, the syntax is wrong. every event handler ecpects a function to be passed.

function doSomething()
{
    // some code
}
window.onload = doSomething;

[ejstefl]

OK - I think I'm not getting it. Here's what I've got:

javascript:window.location.href ="https://mysite.com";
window.onload = PreFill();
function PreFill()
{
document.forms[0].elements["oper"].value ='Eric';
document.forms[0].elements["pswd"].value = 'secret';
}

If I execute this from a different website, it will take me to the desired website but will not fill in the form.

If I execute it from the website I'm trying to go to, it will briefly fill out the name and password fields but then reload the site and remove the info from these fields. Its as if it is not waiting until the site is loaded to run the function PreFill().

[Dormilich]

the syntax on line 2 is still incorrect, see example above.

[ejstefl]

Sorry, but I am still not getting what is wrong with line 2. I tried putting the function call after the function definition, like so:

 javascript:window.location.href ="https://mysite.com";
 function PreFill()
 {
 document.forms[0].elements["oper"].value ='Eric';
 document.forms[0].elements["pswd"].value = 'secret';
 };
 window.onload = PreFill();

but got the same result - it would take me to the page but not prefill anything. I am running this like a bookmarklet - is that the problem? Is there another way I could run it?

[Dormilich]

compare

window.onload = doSomething;

with

window.onload = PreFill();

what’s the difference?

[ejstefl]

The difference is the name of the function and the fact that I have parenthesis and you do not. When I remove the parenthesis, the same thing happens - the page opens, but the fields are not pre loaded. If I rename the function, that does not work either.

[Dormilich]

anyways, putting the parentheses there is simply wrong (for a certain reason).

I’ll do some testing to reproduce the error.

[Dormilich]

after following some links I found that the bookmarklets are treated like links, thus the use of the void() function seems favourable. further investigation to follow.

personally I doubt, that you can execute code after you load another page.

if I try to jump to another page and then execute code, I’m prompted with an XSS warning. no point in trying this approach further.

however, you may use the bookmarklet on your page after you load the page via regular bookmark. this certainly worked.

[ejstefl]

Thanks for your help on this so far.

If a bookmarklet won't work, do you have any other ideas as to how I can approach this? My goal is to have a page that would list all sites that we use a shared password for. When you clicked on the site, it would take you to the site and enter your credentials. Thanks again!

[Dormilich]

When you clicked on the site, it would take you to the site and enter your credentials.

my browser handles those for me, no need to use anything else.

[ejstefl]

Yes, and that is part of the issue. Given that the credentials are shared among several users, and need to be changed every 90 days, we run into problems where the stored credentials become invalid. The user tries multiple times and ends up locking the account, which then needs to be unlocked.

The idea here is that if they used the link I want to create, they would always be using the correct credentials.

[acoder]

One possibility is:

javascript:window.location.href ="https://www.mysite.com/index.html?oper=Eric&pswd=secret";

though you'd have to change the code in the page to take the input parameters and set the username/password.

However, I would advise that whenever the user names and passwords are changed, display a message on the login page to inform the user that the password has changed, so they will know that they need to enter a new password.

Of course, users don't always follow instructions, so one more thing you could look at is to store the old password too, then if that is entered, post a friendly reminder that the password has now changed.

Just some ideas you could look into.