HTML自动填充与Autocomplete属性治理（隐私/表单）最佳实践

背景与价值自动填充可能导致隐私泄露或误填。统一治理可提升安全与一致性。统一规范禁用敏感：在密码、支付等字段禁用或限定自动填充。字段标注：对邮箱、姓名等使用规范的autocomplete值。表单范围：必要时对整个表单禁用自动填充。核心实现封装设置function setAutocomplete(el: HTMLInputElement, value: string) { el.setAttribute('autocomplete', value) }

function applyFormPolicy(form: HTMLFormElement) {

for (const el of Array.from(form.elements)) {

if (!(el instanceof HTMLInputElement)) continue

const name = el.name.toLowerCase()

if (name.includes('password') || name.includes('card') || name.includes('cvv')) setAutocomplete(el, 'off')

else if (name.includes('email')) setAutocomplete(el, 'email')

else if (name.includes('name')) setAutocomplete(el, 'name')

}

}

落地建议在敏感表单禁用自动填充或细化字段值，提升隐私保护与一致性。验证清单敏感字段是否禁用或限定；常用字段是否标注规范值。