Turned off autocomplete for TOTP codes - #4849

Thanks for offering this @ImMattic, Seems like a sensible improvement.
I just double checked the auto-complete attribute on MDN, and I saw there's a specific one-time-code option that looks like it's for this kind of thing.

I wonder if that would also work to prevent standard autofill, while also making it known to browser/extension auth systems for potential autofill?

Also, thanks for the sponsorship!

No problem! I'm always a big proponent of supporting open source whenever possible, especially if I use it.

I didn't know about that OTP attribute. I did just try it on my instance though and unfortunately it doesn't prevent autofill (at least on Firefox). I definitely see how having the OTP attribute would help extensions like Bitwarden to autofill the OTP though. Is it maybe possible to stack attributes together?

Thanks @ImMattic,
Yeah, looking further it's not a supported attribute in Firefox.
Setting off at the form level, then one-time-code at the input level seems to still prevent autofill (tested in Firefox and chrome) while still having one-time-code there for potential other helpful usage.

Additional tweaks made in bc24a13 and d5a6893, which also copies these changes for backup code MFA, and adds some tests to cover.

Now all merged to be part of the next patch release.