Implement "remember password" dialog

[SergeyAvd]

In Chrome when I submit my credentials on a login page the browser prompts "Do you want Google Chrome to save your password for this site?"

As far as I know, there is nothing like this built-in in CEF. So my question is how do I go about implementing it? Are there any CEF APIs available for this?

[SergeyAvd]

My apologies if I didn't explain well what I'm looking for in my original question.
I'm wondering if there is a way with CEF to find out things like:
1. get a callback once the password and username are submitted by the user;
2. when that happens, get password and username values;
3. ideally I want to know that the authentication was successful or not.

Your help is really appreciated!

[magreenblatt]

You provide the user/password in GetAuthCredentials. If login fails you should see an error code in OnResourceLoadComplete.

[SergeyAvd]

Thank you for your response!

I believe GetAuthCredentials is not called for the cases I'm interested in. As far as I can tell it is only called during HTTP Auth type of authentication. To give you an example what I call basic HTTP auth, after Chrome navigates to http://www.aoins.com it shows this dialog:


However, in my experience sign-in forms like below are used much more often than HTTP Auth. That's what I'm interested in.


Once I enter my credentials into the form and sign in, Chrome would show this dialog window:


And I'm wondering if it is possible to replicate this prompt and save password functionality using CEF?

[cretz]

Doing this is probably going to be a bit involved. I haven't done it, but I might so I have done some digging. I would guess first before a request is sent (e.g. OnBeforeBrowse or OnBeforeResourceLoad or somewhere else?) you'd have to find password fields and store their names (and maybe the names of the rest of the fields). Then you'd override OnResourceLoadComplete (or maybe OnResourceResponse or something). Then check that the request method is POST, resource type is main or sub frame, the status is 200, the transition type is form submit. Then check the post data to see if you can match a form that you previously recorded (e.g. by name and anything else you want to check to make sure there aren't ambiguous forms on the page). Then if you can find a unique form, you can assume it was the one submitted and work from there. Another way is to attach submit handlers to all forms (you can even make a MutationObserver to handle ones not present on page load).

Granted this all seems a bit hackish. Digging through chrome source, I think this is mostly what they do but they have a bunch of heuristics to determine username and save it alongside in their password manager. I've yet to find the piece of code where they can identify which form was submitted, but if CEF could provide that, it would be awesome.

[SergeyAvd]

cretz,

That's a good idea. As you said it is going to be somewhat involved, which is fine. I'm going to explore this path later and report back.

Meanwhile, I was thinking about a less involved solution. I was looking at some Chrome extensions for password management (e.g. keeper). As far as I can see they are using chrome.webRequest.onBeforeRequest API.

This issue indicates that some support for extensions started to arrive to CEF master (presumably 3202 release branch). It seems like chrome.webRequest is not yet supported by the current 3202 branch, but it is on the list for the first round of implementation.