I'd love best practices around, say, login forms, e.g.:

- use standard input field names password managers recognize - disable autocompletion and autocapitalization on the login field

- if it's an email, use the correct HTML5 input type

- don't have a form with just a login email and force the user to click to enter the password

- follow NIST SP 800-53, e.g. no SMS 2FA and no arbitrary password rotation and composition rules

Or how many sites that have a form with only one input don't automatically focus on it.

▲

xg15 28 minutes ago | parent | next [-]

> Or how many sites that have a form with only one input don't automatically focus on it.

That's one of the many examples where the "web stack" expects every single website to implement things manually that were standard in native UI toolkits. Then of course the majority of websites will not deem it a priority or not realize it's a thing to consider at all - and we end up in a situation like this.

▲

xg15 an hour ago | parent | prev | next [-]

> don't have a form with just a login email and force the user to click to enter the password

I was noticing that this kind of login forms seems to be proliferating, especially on "big tech" sites. (And personally, I also find it annoying)

Always assumed there was some reason why sites are switching to this pattern, e.g. better bot protection. Does anyone know more about this?

▲

mpetrovich an hour ago | parent | next [-]

I suspect they ask for email first in order to determine whether to log you in via SSO vs. require a password.

	▲	9dev 26 minutes ago \| parent \| next [-]
		As someone who's built just that, can confirm. If users have SSO configured, or a Passkey, or any other policies apply, you first need to identify the account to be able to determine which options to offer - maybe they don't even have a password in the first place, so displaying the field would cause confusion. As a side effect, this also conveniently allows to check for blocked accounts.
	▲	xg15 33 minutes ago \| parent \| prev [-]
		Ah, that would make sense.

▲

jurf an hour ago | parent | prev [-]

I always assumed it was because of SSO redirects

▲

quirino an hour ago | parent | prev | next [-]

I've had good fun reading about best practices for forms in Adam Silver's blog.

https://adamsilver.io/blog/form-design-from-zero-to-hero-all...

He has posted many new things since. Probably one of the best UX resources on the web.

▲

notpushkin 2 hours ago | parent | prev [-]

Evil Martians have a nice write-up on the login forms: https://evilmartians.com/chronicles/html-best-practices-for-...