Adding the Ability to toggle show password at the back office login

[georgebid]

This PR was created by @IbrahimMNada #17041 which adds the ability to toggle a 'show password' in the back office login screen. A big thank you to him for tackling this!

While this is a great idea and a feature many of us are familiar with - it would be quite a big change. Therefore, I have started this discussion to hopefully get a few more ideas & thoughts on how this could be developed.

I spoke to @iOvergaard who will hopefully add his thoughts here 😸

Here are the original screenshots from the PR:

[IbrahimMNada]

Hello Thanks for you support!

@iOvergaard please share your thoughts with me , we will figure something about , thanks

[nul800sebastiaan]

I would like to give some feedback here.

Show password

• The more configurable items we have, the more complex testing gets. Does "show password" really need to be configurable? I don't see the need to be able to remove it from the login screen.
• Making a proper "show password" feature is tricky, as noted in this blog post, we should take all of these learnings in consideration: https://technology.blog.gov.uk/2021/04/19/simple-things-are-complicated-making-a-show-password-option/

Remember me

• What should "remember me" actually do? Currently, in this PR it seems like it's not implemented.
• Current behavior: we have configuration options for timing out users after an amount of inactivity, and if the session cookie hasn't been refreshed for "x" minutes, you would need to re-authenticate.
• Do we want people to be permanently logged in? Making a cookie that creates a persistent login brings an additional risk of that cookie getting stolen and reused by an attacker to get into your system without authentication
• More reading about this: https://stackoverflow.com/questions/549/the-definitive-guide-to-form-based-website-authentication#477579

[IbrahimMNada]

Hello @nul800sebastiaan ,

Thank you for your valuable feedback !

Regrading the configuration

I wanted it to be consistent with the other options you're having at the login page, but no worries! I will remove the configuration and make it always shown.

Regrading Remember me

Remember me was already there but disabled from the configuration , I just enabled it and tweaked it styles to be appropriate if both are enabled, and by the way there are a third option for 'forgot password'

Show password blog post

I have carefully read the blog post you offered and its very insightful , I would like to tell you things that I will do to conform with the blog post :

• Button or checkbox: as they say at GOV.UK they went with button because checkboxes were away from their identity so I think keeping it a checkbox is not a bad idea unless you have something else in mind

• disabling the java script: In Umbraco Backoffice we cant disable the JavaScript ,the generation of the login form is dynamically controlled by the JavaScript and even the whole web component thingy

• Security 'autocomplete=”off” doesn’t work in all browsers' : before submission I will make sure that the password input is changed to password at all times

• Making sure it’s accessible” doesn’t work in all browsers' : I will use aria-controls the screen reader users press the button they are told “your password is shown” or “your password is hidden.

[nul800sebastiaan]

Thanks @IbrahimMNada I am waiting for some more input from the team, so don't spend too much time on this yet.

And cool about the "remember me" - I had no idea that this existed!

[IbrahimMNada]

You're more than welcome!

I'll be waiting for any extra input , your wishes are my commands