Safari Autopassword is Blank String - spring

Question

I have a site with a login form that looks like this.
<h:panelGrid columns="3">
<p:outputLabel value="Username:" for="username"/>
<p:inputText id="username" autocomplete="off" />
<p:message for="username"/>
<p:outputLabel value="Password:" for="password"/>
<p:password id="password" />
<p:message for="password"/>
</h:panelGrid>
We are using Spring security to validate passwords, and when I throw a break point in Spring's UsernamePasswordAuthenticationFilter, the password is always blank when using Safari's autofill password feature. This causes the login to fail.
For reference, here is the portion of Spring's code that my break point is located in
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
if (postOnly && !request.getMethod().equals("POST")) {
throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());
}
String username = obtainUsername(request);
String password = obtainPassword(request);
if (username == null) {
username = "";
}
//My breakpoint is here, but password = "" even though we have a user name
if (password == null) {
password = "";
}
username = username.trim();
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(username, password);
// Allow subclasses to set the "details" property
setDetails(request, authRequest);
return this.getAuthenticationManager().authenticate(authRequest);
}
I'm at a total loss as to what I can check to solve this. This password issue only affects Safari. Other browsers such as IE, Chrome, FF work just fine.

Answer 1

Ok. I found the problem!
<p:defaultCommand target="ndaLoginButton" />
<h:panelGroup styleClass="errorText centered" rendered="#{authenticationBean.failedLogin}">
<h:outputText rendered="#{authenticationBean.isFailedLogin() and not authenticationBean.lockedAccount}"
value="Invalid username or password. Please try again." />
<h:outputText rendered="#{authenticationBean.lockedAccount}"
value="Account locked. You can reset account password below." />
</h:panelGroup>
#{authenticationBean.setFailedLogin(false)}
<h:form id="loginDialogForm" prependId="false">
<h:panelGrid columns="2" styleClass="ndaLoginDialogTable" columnClasses="ndaLoginDialogTop, ndaLoginDialogTop">
<h:panelGroup>
<h:panelGrid columns="3">
<p:outputLabel value="Username:" for="username"/>
<p:inputText id="username" autocomplete="off" />
<p:message for="username"/>
<p:outputLabel value="Password:" for="password"/>
<p:password id="password" autocomplete="off" />
<p:message for="password"/>
</h:panelGrid>
<input type="submit" style="visibility: hidden;" onclick="$j('#ndaLoginButton').click();"/>
<input type="hidden" id="loginDialogSubmit" name="loginDialogSubmit" value="loginDialogSubmit" />
<input type="hidden" id="loginDialogRedirect" name="loginDialogRedirect" />
</h:panelGroup>
<h:panelGroup>
<p:commandButton id="ndaLoginButton" value="NDA Login" type="submit" action="#{loginDialogPageBean.login}"
ajax="false" onclick="ndar.showPreloader()"/>
</h:panelGroup>
</h:panelGrid>
</h:form>
The problem is the <p:defaultCommand> tag. This tag is used to specify which control gets pressed when the user hits the enter key on the keyboard. What was happing was that Safari was sending a virtual enter key press prior to populating the password field on the form. I solved the problem by simply removing this <p:defaultCommand> tag since it wasn't necessary anyway.