Skip to content

Chrome autofill fills the registration honeypot, so real registrations are silently dropped #72

Closed

Description

@0xHouss

Chrome autofill fills the registration form's hidden honeypot field, so the server treats real applicants as bots and drops their registration while telling them it succeeded.

The problem

  • The honeypot is a hidden text input named company (REGISTRATION_HONEYPOT_FIELD in src/lib/registrations/schema.ts).
  • Chrome recognizes "company" as an address field and fills it from the visitor's saved address profile when they autofill the form. It ignores autoComplete="off" on such fields.
  • src/actions/public/submit-registration.ts returns { status: "success" } as soon as the honeypot has a value, before validating or saving anything.

Seen in a real applicant's network log: the request carried company filled with their employer from their autofill profile, the server answered success, and nothing was saved. They submitted several times from that Chrome, with no duplicate stored; only their attempt from another browser (no autofill profile) was saved.

Anyone whose Chrome autofill profile includes a company can lose their registration without knowing.

Expected

  • Autofill never fills the honeypot: give it a name and attributes no browser maps to an autofill field (not company, organization, website, url, name, email, phone, address words).
  • Check the contact form's honeypot (website, src/lib/contact/schema.ts) for the same problem.
  • Real applicants who autofill the form are saved.

cc @Adel2411

Activity

  1. Adel2411 commented on Nov 6, 2026

    @Adel2411
    Contributor

    Resolved by merged PR #78. Work is merged to dev.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions