Login or Checkout Iframe That Strips Out Autocomplete Support

Why it matters

Midway through setting up their profile, a user taps the premium upsell to unlock unlimited likes and has to manually type their full card number and billing name because the embedded payment iframe strips autocomplete.

How to test

Try autofilling a login/checkout field inside an iframe: if the iframe's sandbox or attributes strip autocomplete, it fails even if the token itself looks correct.

How to fix

Inside that iframe, the card number and name fields have autocomplete stripped by the embedding configuration, so make sure sandboxed checkout iframes do not strip autocomplete tokens from their internal fields, and avoid sandbox flags that block autofill unnecessarily.

<iframe src="https://payments.example.com/checkout" sandbox="allow-scripts allow-same-origin allow-forms"></iframe>

Outcome

Mid-setup, a user upgrading to premium can now autofill their saved card details inside the checkout iframe instead of retyping everything.

Who is affected

Users with saved payment autofill data, and people with motor disabilities who depend on it, must retype every field by hand mid-setup instead of finishing the upgrade quickly.