Secure phx.gen.auth forms against PII leakage

[rhcarvalho]

References:

• Article on "Spell-jacking" from 2022: https://www.bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellcheck/

  Extended spellcheck features in Google Chrome and Microsoft Edge web browsers transmit form data, including personally identifiable information (PII) and in some cases, passwords, to Google and Microsoft respectively.

  Both Chrome and Edge ship with basic spellcheckers enabled. But, features like Chrome's Enhanced Spellcheck or Microsoft Editor when manually enabled by the user, exhibit this potential privacy risk.
  ...
  "Furthermore, if you click on 'show password,' the enhanced spellcheck even sends your password, essentially Spell-Jacking your data," explains otto-js in a blog post.

  Reacting to otto-js' report, both AWS and LastPass mitigated the issue. In LastPass' case, the remedy was reached by adding a simple HTML attribute spellcheck="false" to the password field

• MDN: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Global_attributes/spellcheck#security_and_privacy_concerns

Some sites implementing spellcheck="false":

• The AWS Console login page sets spellcheck="false" on all input fields: https://aws.amazon.com/console/
• Same for LastPass: https://app.lastpass.com/login/
• 1password: https://my.1password.com/signin
• Google: https://accounts.google.com/
• Apple: https://account.apple.com/

Some that don't:

• Microsoft: https://account.microsoft.com/account

[rhcarvalho]

I split the PR into two commits in case we want to leave out the password inputs, though I don't see much reason to do it. The sites that bother setting spellcheck="false" seem to set it for all form fields.

[MzudemO]

To add some newer context: In Chromium-based browsers this issue has been fixed for password fields since 2022 https://issues.chromium.org/issues/40238870

The Microsoft Editor add-on has been disabled as of October 2025. It's now built-in to the Edge browser, but likely has the same behaviour as the extension did previously.

Irrespective of that any spellchecking tool can of course have this vulnerability, though they are also free to simply ignore spellcheck="false" if malicious.

[rhcarvalho]

Thanks for the comment @MzudemO!

Irrespective of that any spellchecking tool can of course have this vulnerability, though they are also free to simply ignore spellcheck="false" if malicious.

👍 The intention/expectation here is not to solve for malicious extensions or other things like AI systems reading your screen.

It is, however, intended to assist devs/users unaware of accidentally leaking information to third-parties (for the same reasons we still see to this day high profile sites applying the technique).