How to programmatically set the value of a WebKit password text field?

Question

Update: this question is bunk. Move along, nothing to see here. You can set the value of the password text field from either JS or ObjC. I was wrong.

I have a WebKit-based Cocoa app which loads an HTML document containing an HTML form in a WebView. The HTML form contains a password text field like:

<form name="foo">
    <input type="password" name="bar">
</form>

I'd like to set the value of this text field programmatically (from Objective-C if possible, but I'll do whatever works).

I believe WebKit (and every other modern browser) implements a JavaScript security feature which prevents JS scripts from setting this value programmatically.

Unfortunately, it seems that the same security restriction applies to Objective-C, as I can't seem to set the value using ObjC either. While the JS restriction is reasonable, the ObjC seems a bit unreasonable.

Is there any way to programmatically set the value of this field (short of bundling a custom WebKit in my app that has been altered to allow this)? I'm open to any suggestion.

Here's what I've tried in ObjC:

DOMHTMLDocument *doc = (DOMHTMLDocument *)[webView mainFrameDocument];
DOMHTMLFormElement *formEl = (DOMHTMLFormElement *)[[doc forms] namedItem:@"foo"];
DOMHTMLInputElement *inputEl = (DOMHTMLInputElement *)[[formEl elements] namedItem:@"bar"];
[inputEl setValue:@"baz"];

this has no effect.

Answer 1

how about trying to set the field as a normal text field then programmatically changing it to a password field all while the display of the field is :none then change it back to visible.

Answer 2

I would use -stringByEvaluatingJavaScriptFromString:.

Here's what I used (I added an 'id' attribute to the field to make it easier to grab):

[_webView stringByEvaluatingJavaScriptFromString: @"document.getElementById(\"bar\").value = \"hello\""];

Answer 3

The restriction is probably because the DOM bridge hooks directly into the same code as the javascript runtime, so you need to bypass any javascript/DOM bridge.

Maybe you could set the focus on the field (if the bridge allows just that) and send keyboard events to the WebView or the Document view.

Alternatively, since those fields are native OS X components you could potentially directly talk to these (and the WebKit source code should help you figure how to get to them).

Sorry, both solutions are a little involved and I have no idea if that works! Maybe the webkitdev mailing list would have an answer, or you could try to ask the 1Password developer ;-)

Answer 4

This should definitely work without having to jump through any hoops to do so. I just wrote a quick test app that loaded http://mail.google.com/ and signed into it fine with the following code on SnowLeopard and Leopard:

- (void)webView:(WebView *)sender didFinishLoadForFrame:(WebFrame *)frame
{
    if (![[sender mainFrame] isEqual:frame])
        return;

    DOMHTMLFormElement *form = (DOMHTMLFormElement *)[[frame DOMDocument] getElementById:@"gaia_loginform"];
    DOMHTMLInputElement *username = (DOMHTMLInputElement *)[[form elements] namedItem:@"Email"];
    [username setValue:@"myemailacct"];

    DOMHTMLInputElement *password = (DOMHTMLInputElement *)[[form elements] namedItem:@"Passwd"];
    [password setValue:@"omghi"];

    [form submit];
}

I also have very similar code at work whose only job is to sign into website and its been working fine on Tiger for a year. In that case I do everything, including creating the WebView via code. I would also be very surprised if Safari's autofill didn't use very similar code to this.

That said, I would make sure your app isn't doing anything crazy to the WebView. Do you do any other modification the DOM anywhere else? Try doing this in a sample app like I did and see if it works there.

Is the HTML you're loading your own or on a remote server? Some websites include Javascript that clears out form fields on load or a second or two after to prevent autofill. Perhaps you're running into that?

If all else fails, make sure nothing is being logged to the WebView's console. You can see that by opening up the web inspector or temporarily implementing the private WebUIDelegate method:

- (void)webView:(WebView *)webView addMessageToConsole:(NSDictionary *)message;