Open Radar

 
Summary:
The ‘autocomplete="new-password"’ attribute on an <input> tag lets you identify a password-changing field to autofill. However, there’s no corresponding "new-username" value.

Steps to Reproduce:
1. Write a web app that allows you to change an account’s username, with code something like: 
    <input type="hidden" autocomplete="username" value="foo">
    <label for="username">Username:</label>
    <input type="text" autocomplete="new-username" id="username" name="username" value="foo">
2. Load the “change username” page in Safari.
3. Change the username field to “bar”.
4. Submit the form.

Expected Results:
On a successful result from the server, the keychain entry for “foo” is changed to be for “bar” instead, probably with a confirmation prompt like the one Safari shows for password changes.

Actual Results:
Safari doesn’t understand ‘autocomplete="new-username"’, and so it doesn’t do anything special with this form.

Notes:
It might be nice if, instead of requiring the hidden field, Safari looked at the new-username field’s defaultValue to determine the old username. This isn't important for new-password fields because they don't contain the current password (at least if the passwords are being stored securely), but new-username fields are usually filled in.