Autocomplete attribute has valid value

Description

This rule checks that the HTML autocomplete attribute has a correct value.

Applicability

This rule applies to any HTML input, select and textarea element with an autocomplete attribute value that is neither empty ("") nor only ASCII whitespace, except if one or more of the following is true:

• toggle: the autocomplete attribute consists of a single token that is an ASCII case-insensitive match for the string off or the string on; or
• disabled: the element is a disabled element; or
• fixed value: the element is an input element with a type attribute value of button, checkbox, file, image, radio, reset or submit; or
• hidden: the element is not visible, and not included in the accessibility tree; or
• static: the element is not part of sequential focus navigation and has a semantic role that is not a widget role.

Expectation

Each test target’s autocomplete attribute value is a space separated list of one or more tokens that follow the HTML specification for Autofill detail tokens, which requires that the token list match the following in the correct order:

1. An optional token that starts with “section-“; then
2. An optional token of either “shipping” or “billing”; then
3. An optional token of either “home”, “work”, “mobile”, “fax” or “pager”, only if the next token is “email”, “impp”, “tel” or “tel-*”; then
4. A required token from the correct autocomplete field; then
5. An optional “webauthn” token.

Assumptions

The autocomplete attribute is used on form fields that correspond to Input Purposes for User Interface Components and collect information about the user.

If the autocomplete attribute is used to describe “custom” taxonomy, for example using the custom autocomplete value “banner” (<input type="text" autocomplete="banner" />), success Criterion 1.3.5 Identify Input Purpose may be satisfied even if this rule failed.

The aria-disabled state is used on input elements which are not part of sequential focus navigation and are not otherwise operable. If this is not the case, this rule may be inapplicable on elements that are still operable and require a valid autocomplete attribute to satisfy success criterion 1.3.5 Identify Input Purpose.

The purpose of a control is programmatically identifiable even when its autocomplete attribute value is not an appropriate field name for the form control.

Accessibility Support

• While autocomplete is a promising technique for supporting personalization in HTML, support for this in assistive technologies is fairly limited.
• Implementation of Presentational Roles Conflict Resolution varies from one browser or assistive technology to another. Depending on this, some elements can have a semantic role of none and fail this rule with some technology but users of other technologies would not experience any accessibility issue.
• Some user agents treat the value of the aria-disabled attribute as case-sensitive.
• In some user agents, querying the value of the autocomplete property returns an empty string (“”) even when the attribute was set according to the rule’s expectations. It affects assistive technologies which rely on this property to personalize input fields collecting information about the user.

Background

The intent of this rule is to ensure that the autocomplete attribute can be used to support personalization. Many users may find it easier to fill out forms if those can be styled or laid out in a way that is familiar to them. Assistive technologies can do this when a form control is marked up in such a way that its purpose can be understood. For instance, assistive technologies could add familiar icons and colors to different fields, making it easier for the user to understand what the form does.

Many browsers provide auto-filling suggestions even when the control’s type attribute value is not appropriate for its autocomplete attribute value. The same happens when the autocomplete property is queried. However, the autocomplete property is not programmatically identifiable if the requirements for the optional tokens are not met.

The auto-completing feature of the autocomplete attribute benefits many users, but it is not required to satisfy success Criterion 1.3.5 Identify Input Purpose. Setting autocomplete="off" on the element’s form owner prevents the user agent from completing it, but it does not prevent the autocomplete attribute value from being programmatically identifiable.

The fixed value condition in the Applicability is excluding input elements who do not consider the autocomplete attribute, based on their type attribute value; input elements with a type attribute value of hidden are excluded by the hidden condition.

On an input element with a type attribute value of hidden, the autocomplete attribute wears the autofill anchor mantle, describing the meaning of the given value. In all other cases, it wears the autofill expectation mantle.

Bibliography

• Understanding Success Criterion 1.3.5: Identify Input Purpose
• Definition: programmatically determined (programmatically determinable)
• Autofill

Accessibility Requirements Mapping

• 1.3.5 Identify Input Purpose (Level AA)

  • Learn more about 1.3.5 Identify Input Purpose
  • Required for conformance to WCAG 2.1 on level AA and higher.
  • Outcome mapping:
    • Any failed outcomes: success criterion is not satisfied
    • All passed outcomes: success criterion needs further testing
    • An inapplicable outcome: success criterion needs further testing

Input Aspects

The following aspects are required in using this rule.

• Accessibility Tree
• DOM Tree
• CSS Styling

Test Cases

Passed

Passed Example 1

Open in a new tab

This autocomplete attribute value only has the required token “username”.

<label>Username<input autocomplete="username"/></label>

Passed Example 2

Open in a new tab

The autocomplete attribute value of this select element has the required token “bday-month”. The element’s form owner has autocomplete="off", which prevents the user agent from completing it. It does not prevent the autocomplete attribute value from being programmatically identifiable.

<form autocomplete="off">
	<label
		>Birthday month
		<select autocomplete="bday-month">
			<option>January</option>
			<option>...</option>
		</select>
	</label>
</form>

Passed Example 3

Open in a new tab

This autocomplete attribute value only has the required token “street-address”. Mixing upper and lower case letters is allowed for autocomplete attributes.

<label> Street address<textarea autocomplete="Street-Address"></textarea></label>

Passed Example 4

Open in a new tab

This autocomplete attribute value list includes a work token, allowed because it is used before email.

<label>Work email<input autocomplete="work email"/></label>

Passed Example 5

Open in a new tab

This autocomplete attribute value list includes a section- token, which can preface any correct autocomplete field.

<label>Partner's email address<input autocomplete="section-partner email"/></label>

Passed Example 6

Open in a new tab

This autocomplete attribute value list includes section- and billing tokens. These tokens can preface any correct autocomplete field.

<label>Billing address- first line<input type="text" autocomplete="section-primary billing address-line1"/></label>

Passed Example 7

Open in a new tab

This autocomplete attribute value list includes all allowed types of tokens in the correct order.

<label>Office email<input type="text" autocomplete="section-primary shipping work email"/></label>

Passed Example 8

Open in a new tab

This autocomplete attribute value only has the required token “bday-day”. It remains programmatically identifiable even though it is inappropriate for the control’s type attribute value “tel”.

<label>Birthday day<input name="bdayday" type="tel" autocomplete="bday-day"/></label>

Passed Example 9

Open in a new tab

This autocomplete attribute value has the required token “current-password”, followed by the optional “webauthn” token.

<label>
	Password
	<input type="password" autocomplete="current-password webauthn" />
</label>

Failed

Failed Example 1

Open in a new tab

This autocomplete attribute value has an unknown term that is not a correct autocomplete field.

<label>Username<input autocomplete="badname"/></label>

Failed Example 2

Open in a new tab

This autocomplete attribute value has the work token which is a correct autocomplete field. However, work can not be used with photo.

<label>Photo<input autocomplete="work photo"/></label>

Failed Example 3

Open in a new tab

This autocomplete attribute value includes the work token before the shipping token, instead of the other way around.

<label>Email<input autocomplete="work shipping email"/></label>

Failed Example 4

Open in a new tab

This autocomplete attribute value is comma separated instead of space using ASCII whitespace.

<label>Email<input autocomplete="work,email"/></label>

Failed Example 5

Open in a new tab

The autocomplete attribute value is on an input element that does not have a semantic role that is a widget role, but still participates in sequential focus navigation because of the tabindex attribute.

<label>Username<input role="banner" tabindex="0" autocomplete="banner"/></label>

Failed Example 6

Open in a new tab

This autocomplete attribute does not contain any required token.

<label>Address<input autocomplete="shipping"/></label>

Failed Example 7

Open in a new tab

This autocomplete attribute contains two of the required tokens, but only one is allowed.

<label>Address<input autocomplete="address-line1 address-line2"/></label>

Failed Example 8

Open in a new tab

This autocomplete attribute contains a work modifier but no required token afterwards.

<label>Email<input autocomplete="work"/></label>

Failed Example 9

Open in a new tab

This autocomplete attribute contains an extra token after the allowed ones.

<label>Password<input type="password" autocomplete="current-password webauthn invalid"/></label>

Failed Example 10

Open in a new tab

This autocomplete attribute contains an extra token after the allowed ones.

<label>Email<input autocomplete="email invalid"/></label>

Inapplicable

Inapplicable Example 1

Open in a new tab

This autocomplete attribute value is empty (“”).

<label>Username<input autocomplete=""/></label>

Inapplicable Example 2

Open in a new tab

This autocomplete attribute value contains only ASCII whitespace.

<label>Username<input autocomplete=" "/></label>

Inapplicable Example 3

Open in a new tab

This autocomplete attribute value is on an element that is not visible through display:none.

<label>Username<input autocomplete="badname" style="display:none"/></label>

Inapplicable Example 4

Open in a new tab

This autocomplete attribute is on an input element that has the disabled attribute.

<label>Username<input autocomplete="badname" disabled/></label>

Inapplicable Example 5

Open in a new tab

This autocomplete attribute is on an input element that has the aria-disabled attribute value of true.

<label>Username<input autocomplete="badname" aria-disabled="true"/></label>

Inapplicable Example 6

Open in a new tab

This autocomplete attribute is ignored because it is on an element with a semantic role of none. The disabled attribute is required to ensure presentational roles conflict resolution does not cause the none role to be ignored.

<label>Username<input type="text" role="none" disabled autocomplete="badname"/></label>

Inapplicable Example 7

Open in a new tab

This autocomplete attribute is inapplicable because it has the off value.

<label>Friend's first name<input type="text" autocomplete="off"/></label>

Inapplicable Example 8

Open in a new tab

This input element has a fixed value due to its type attribute value of submit. autocomplete does not apply to Submit buttons.

<input type="submit" autocomplete="email"/>

Inapplicable Example 9

Open in a new tab

This input element is hidden because of its type attribute value of hidden (following standard User Agent style sheet recommendations. Knowing the transaction amount may still be used in other fields, e.g. to suggest a card with sufficient balance; this is not tested by this rule.

<input type="hidden" autocomplete="transaction-amount" value="100.00">

Glossary

Appropriate field for the form control

The field name of the form control is appropriate if it is listed in the autocomplete fields table from the HTML 5.2 specification as applying to the specified control group. https://html.spec.whatwg.org/#inappropriate-for-the-control.

Attribute value

The attribute value of a content attribute set on an HTML element is the value that the attribute gets after being parsed and computed according to specifications. It may differ from the value that is actually written in the HTML code due to trimming whitespace or non-digits characters, default values, or case-insensitivity.

Some notable case of attribute value, among others:

• For enumerated attributes, the attribute value is either the state of the attribute, or the keyword that maps to it; even for the default states. Thus <input type="image" /> has an attribute value of either Image Button (the state) or image (the keyword mapping to it), both formulations having the same meaning; similarly, “an input element with a type attribute value of Text” can be either <input type="text" />, <input /> (missing value default), or <input type="invalid" /> (invalid value default).
• For boolean attributes, the attribute value is true when the attribute is present and false otherwise. Thus <button disabled>, <button disabled="disabled"> and <button disabled=""> all have a disabled attribute value of true.
• For attributes whose value is used in a case-insensitive context, the attribute value is the lowercase version of the value written in the HTML code.
• For attributes that accept numbers, the attribute value is the result of parsing the value written in the HTML code according to the rules for parsing this kind of number.
• For attributes that accept sets of tokens, whether space separated or comma separated, the attribute value is the set of tokens obtained after parsing the set and, depending on the case, converting its items to lowercase (if the set is used in a case-insensitive context).
• For aria-* attributes, the attribute value is computed as indicated in the WAI-ARIA specification and the HTML Accessibility API Mappings.

This list is not exhaustive, and only serves as an illustration for some of the most common cases.

The attribute value of an IDL attribute is the value returned on getting it. Note that when an IDL attribute reflects a content attribute, they have the same attribute value.

Correct autocomplete field

Any field name listed in the autocomplete fields table from the HTML 5.2 specification: https://html.spec.whatwg.org/#autofill-field

Disabled Element

An element is disabled when it has been rendered inoperable in one or more of the following ways:

1. The element matches the :disabled pseudo-class. For HTML elements this means that the element is actually disabled.

2. The element has a shadow-including ancestor whose aria-disabled attribute value is “true”.

Explicit Semantic Role

The explicit semantic role of an element is determined by its role attribute (if any).

The role attribute takes a list of tokens. The explicit semantic role is the first valid role in this list. The valid roles are all non-abstract roles from WAI-ARIA Specifications. If the element has no role attribute, or if it has one with no valid role, then this element has no explicit semantic role.

Other roles may be added as they become available. Not all roles will be supported in all assistive technologies. Testers are encouraged to adjust which roles are allowed according to the accessibility support base line. For the purposes of executing test cases in all rules, it should be assumed that all roles are supported by assistive technologies so that none of the roles fail due to lack of accessibility support.

Focusable

An element is focusable if one or both of the following are true:

• the element is part of sequential focus navigation; or
• the element has a tabindex value that is not null.

Exception: Elements that lose focus during a period of up to 1 second after gaining focus, without the user interacting with the page the element is on, are not considered focusable.

Notes:

• The 1 second time span is an arbitrary limit which is not included in WCAG. Given that scripts can manage the focus state of elements, testing the focusability of an element consistently would be impractical without a time limit.
• The tabindex value of an element is the value of the tabindex attribute parsed using the rules for parsing integers. For the tabindex value to be different from null, it needs to be parsed without errors.

Implicit Semantic Role

The implicit semantic role of an element is a pre-defined value given by the host language which depends on the element and its ancestors.

Implicit roles for HTML and SVG, are documented in the HTML accessibility API mappings (working draft) and the SVG accessibility API mappings (working draft).

Included in the accessibility tree

Elements included in the accessibility tree of platform specific accessibility APIs are exposed to assistive technologies. This allows users of assistive technology to access the elements in a way that meets the requirements of the individual user.

The general rules for when elements are included in the accessibility tree are defined in the core accessibility API mappings. For native markup languages, such as HTML and SVG, additional rules for when elements are included in the accessibility tree can be found in the HTML accessibility API mappings (working draft) and the SVG accessibility API mappings (working draft).

For more details, see examples of included in the accessibility tree.

Programmatically hidden elements are removed from the accessibility tree. However, some browsers will leave focusable elements with an aria-hidden attribute set to true in the accessibility tree. Because they are hidden, these elements are considered not included in the accessibility tree. This may cause confusion for users of assistive technologies because they may still be able to interact with these focusable elements using sequential keyboard navigation, even though the element should not be included in the accessibility tree.

Marked as decorative

An element is marked as decorative if one or more of the following conditions is true:

• it has an explicit role of none or presentation; or
• it is an img element with an alt attribute whose value is the empty string (alt=""), and with no explicit role.

Elements are marked as decorative as a way to convey the intention of the author that they are pure decoration. It is different from the element actually being pure decoration as authors may make mistakes. It is different from the element being effectively ignored by assistive technologies as rules such as presentational roles conflict resolution may overwrite this intention.

Elements can also be ignored by assistive technologies if they are programmatically hidden. This is different from marking the element as decorative and does not convey the same intention. Notably, being programmatically hidden may change as users interact with the page (showing and hiding elements) while being marked as decorative should stay the same through all states of the page.

Namespaced Element

An element with a specific namespaceURI value from HTML namespaces. For example an “SVG element” is any element with the “SVG namespace”, which is http://www.w3.org/2000/svg.

Namespaced elements are not limited to elements described in a specification. They also include custom elements. Elements such as a and title have a different namespace depending on where they are used. For example a title in an HTML page usually has the HTML namespace. When used in an svg element, a title element has the SVG namespace instead.

Outcome

An outcome is a conclusion that comes from evaluating an ACT Rule on a test subject or one of its constituent test target. An outcome can be one of the three following types:

• Inapplicable: No part of the test subject matches the applicability
• Passed: A test target meets all expectations
• Failed: A test target does not meet all expectations

Note: A rule has one passed or failed outcome for every test target. When there are no test targets the rule has one inapplicable outcome. This means that each test subject will have one or more outcomes.

Note: Implementations using the EARL10-Schema can express the outcome with the outcome property. In addition to passed, failed and inapplicable, EARL 1.0 also defined an incomplete outcome. While this cannot be the outcome of an ACT Rule when applied in its entirety, it often happens that rules are only partially evaluated. For example, when applicability was automated, but the expectations have to be evaluated manually. Such “interim” results can be expressed with the incomplete outcome.

Programmatically Hidden

An HTML element is programmatically hidden if either it has a computed CSS property visibility whose value is not visible; or at least one of the following is true for any of its inclusive ancestors in the flat tree:

• has a computed CSS property display of none; or
• has an aria-hidden attribute set to true

Note: Contrary to the other conditions, the visibility CSS property may be reverted by descendants.

Note: The HTML standard suggests setting the CSS display property to none for elements with the hidden attribute. While not required by HTML, all modern browsers follow this suggestion. Because of this the hidden attribute is not used in this definition. In browsers that use this suggestion, overriding the CSS display property can reveal elements with the hidden attribute.

Semantic Role

The semantic role of an element is determined by the first of these cases that applies:

1. Conflict If the element is marked as decorative, but the element is included in the accessibility tree; or would be included in the accessibility tree when it is not programmatically hidden, then its semantic role is its implicit role.
2. Explicit If the element has an explicit role, then its semantic role is its explicit role.
3. Implicit The semantic role of the element is its implicit role.

This definition can be used in expressions such as “semantic button” meaning any element with a semantic role of button.

Visible

Content perceivable through sight.

Content is considered visible if making it fully transparent would result in a difference in the pixels rendered for any part of the document that is currently within the viewport or can be brought into the viewport via scrolling.

Content is defined in WCAG.

For more details, see examples of visible.

WAI-ARIA specifications

The WAI ARIA Specifications group both the WAI ARIA W3C Recommendation and ARIA modules, namely:

• Accessible Rich Internet Applications (WAI-ARIA) 1.2
• WAI-ARIA Graphics Module 1.0
• Digital Publishing WAI-ARIA Module 1.0

Note: depending on the type of content being evaluated, part of the specifications might be irrelevant and should be ignored.

Rule Versions

1. Latest version, 31 August 2023 (compare)
   • Update to allow webauthn token
   • Add several more examples
2. Previous version, 23 June 2022 (compare)
   • Account for focus redirects in "focusable" definition
   • Let hidden attribute be handled by display:none in "programmatically hidden" definition
3. Previous version, 28 January 2022

Implementations

This section is not part of the official rule. It is populated dynamically and not accounted for in the change history or the last modified date.

Implementation	Type	Consistency	Report
Alfa (fully automated) 0.80.0	Automated tool	Consistent
Alfa (semi-automated) 0.80.0	Semi-automated tool	Consistent
Axe DevTools Pro 4.37.1	Semi-automated tool	Consistent
Axe-core 4.8.3	Automated tool	Consistent
QualWeb 3.0.0	Automated tool	Consistent
SortSite 6.45	Automated tool	Consistent
Total Validator 17.4.0	Linter	Consistent
Total Validator (+Browser) 17.4.0	Automated tool	Consistent