# Prevent form\_for password\_field from auto filling

**URL:** <https://www.ruby-forum.com/t/prevent-form-for-password-field-from-auto-filling/110955>\
**Category:** Rails\
**Created:** [August 1, 2007, 2:08pm UTC](https://www.ruby-forum.com/t/prevent-form-for-password-field-from-auto-filling/110955 "2007-08-01T14:08:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mindtonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f19dbf/32.png) [@mindtonic](https://www.ruby-forum.com/u/mindtonic)\
**Post date:** [August 1, 2007, 2:08pm UTC](https://www.ruby-forum.com/t/prevent-form-for-password-field-from-auto-filling/110955/1 "2007-08-01T14:08:20Z")

</div>

How do you tell a form not to automatically include the database  
information?

I do not want the password to appear.

\<% form\_for :user, :url =\> user\_url(@user), :html =\> { :method  
=\> :put } do |f| -%\>

Username:  
\<%= f.text\_field :username, :size =\> 40 %\>

Email:  
\<%= f.text\_field :email, :size =\> 60 %\>

Password:  
\<%= f.password\_field :password, :size =\> 60 %\>

\<% end %\>

---

<div class="post-metadata">

**Author:** ![mindtonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f19dbf/32.png) [@mindtonic](https://www.ruby-forum.com/u/mindtonic)\
**Post date:** [August 1, 2007, 3:29pm UTC](https://www.ruby-forum.com/t/prevent-form-for-password-field-from-auto-filling/110955/2 "2007-08-01T15:29:29Z")

</div>

On 8/1/07, Mindtonic [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ```
> <p>Password:<br /><%= f.password_field :password, :size => 60 %></p>
> 
> ```
> 
> \<% end %\>

Er, perhaps don’t store the password in your model? Use  
password\_field\_tag otherwise.

–  
Rick O.  
[http://lighthouseapp.com](http://lighthouseapp.com)  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)

---

<div class="post-metadata">

**Author:** ![mindtonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f19dbf/32.png) [@mindtonic](https://www.ruby-forum.com/u/mindtonic)\
**Post date:** [August 1, 2007, 5:00pm UTC](https://www.ruby-forum.com/t/prevent-form-for-password-field-from-auto-filling/110955/3 "2007-08-01T17:00:42Z")

</div>

How can I tell it not to store the password in the model. I know that  
it is pulling the properties directly from the database.

---

<div class="post-metadata">

**Author:** ![mindtonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f19dbf/32.png) [@mindtonic](https://www.ruby-forum.com/u/mindtonic)\
**Post date:** [August 1, 2007, 5:43pm UTC](https://www.ruby-forum.com/t/prevent-form-for-password-field-from-auto-filling/110955/4 "2007-08-01T17:43:47Z")

</div>

[[Please don’t top post as it makes the discussion more difficult to  
follow.]]

On Aug 1, 2007, at 9:59 , Mindtonic wrote:

> How can I tell it not to store the password in the model. I know that  
> it is pulling the properties directly from the database.

I believe what Rick is saying is don’t store the password in the  
database at all. For example, you can hash the password (with a salt  
for better security) and store the hash and the salt in the database.  
Check out the acts\_as\_authenticated or restful\_authentication plugins  
for examples of how this is done.

Michael G.  
grzm seespotcode net

---

<div class="post-metadata">

**Author:** ![mindtonic](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f19dbf/32.png) [@mindtonic](https://www.ruby-forum.com/u/mindtonic)\
**Post date:** [August 2, 2007, 3:31am UTC](https://www.ruby-forum.com/t/prevent-form-for-password-field-from-auto-filling/110955/5 "2007-08-02T03:31:47Z")

</div>

If I understand correctly, the objective is to allow the user to enter  
a password which is then updated in the database, but you don’t want  
the password displayed? Is that correct? Then if so, you could put  
the following in your model

def password

# return nothing so no one ever sees

# the password

“”  
end

def password=§

# if nothing provided and we already have a password set then don’t

overwrite

# since we assume a password was set already. Otherwise

# set the password

if p.blank?  
return  
else  
write\_attribute(“password”, p)  
end  
end

However this isn’t a satisfactory real world solution. Several good  
password and authentication  
schemes have been mentioned. There’s a good description one strategy  
in Rails Recipes on page 135.

Cheers, --Kip