regression: TypeAhead select now has a browser-based pop-up

[garrett]

In Cockpit, the TypeAhead select now has a browser-based pop-up on top of the PatternFly typeahead. (This also affects every project using the TypeAhead of PatternFly React. It's not Cockpit-specific.)

This is due to the PR #6623 landing which actually causes the bug that #6625 talks about.

There is no "never" value for the autocomplete attribute. The correct value is "off" in almost every case. The only other value that makes sense is "new-password" for when an using typeahead for user names, else a password manager (including the built-in browser-based password managers) may show a pop-up.

Setting it to "never" means that it will autocomplete anything with a "never" attribute. This usually will result in no secondary popup on the first time, but a secondary popup is guaranteed on additional uses.

[garrett]

I left some details @ #6623 (comment); quoting here:

This change specifically makes it so we do experience browser autocomplete on top of PatternFly autocomplete. In other words, this change is a breaking one that actually does the opposite of what is intended.

There's no "never" attribute listed on any documentation or spec pages, but there is an "off", which is suggest to be used in cases where autocomplete is not wanted. (The exception is user/pass forms where password managers still work with "off", but this isn't for autocomplete in most cases. In that specific case, it's suggested to use "new-password"... and this wouldn't be case for the typeahead select, unless it's used for user selection. And it usually isn't used for user selection.)

• https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes/autocomplete

  "off"

  The browser is not permitted to automatically enter or select a value for this field. It is possible that the document or application provides its own autocomplete feature, or that security concerns require that the field's value not be automatically entered.

• https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill

  When wearing the autofill expectation mantle, the autocomplete attribute, if specified, must have a value that is an ordered set of space-separated tokens consisting of either a single token that is an ASCII case-insensitive match for the string "off", or a single token that is an ASCII case-insensitive match for the string "on", or autofill detail tokens.

[garrett]

Suggestion:

1. Revert Fix for no autocomplete for Typeahead Select #6623 to fix the general case.
2. Make a new PR that sets autocompletes to "new-user" when the input is set to "user", to work around password manager popups.

[jelly]

The issue can be seen here with the latest cockpit-podman.