Bug: Silent browser autofill in Access List Authorization tab causes unintended Basic Auth (Relates to #3613)

[andsyrovatko]

Checklist

• Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
  • Yes (Tested on jc21/nginx-proxy-manager:2.15.1 / latest)
• Are you sure you're not using someone else's docker image?
  • Yes
• Have you searched for similar issues (both open and closed)?
  • Yes

Describe the bug

Reopening discussion regarding #3613.

When editing or updating an existing Access List (for example, adding a new IP address to the "Access Rules" tab), the browser's password manager (Chrome/Firefox) automatically fills in saved NPM login credentials into the hidden/unopened "Authorization" tab fields (Username and Password).

Since the "Authorization" tab is not actively open during IP edits, this change happens unnoticed. Upon saving, basic authentication is silently enabled for the Access List, causing all proxied users to be unexpectedly prompted for HTTP Basic Auth credentials.

While I understand browser autofill can be aggressive, the current behavior silently breaks production access rules. Editing an IP address automatically applies saved NPM admin credentials to the Authorization tab, silently enforcing Basic Auth for proxy hosts.

Nginx Proxy Manager Version

v2.15.1

To Reproduce
Steps to reproduce the behavior:

1. Save your NPM admin login/password credentials in Chrome or Firefox password manager.
2. Go to Access Lists and edit an existing list (or create a new one).
3. Navigate to the Access Rules tab and add a new IP address.
4. (Do not open or edit the "Authorization" tab).
5. Click Save.

Result: The saved credentials from the browser were silently inserted into the Authorization tab inputs on submit, enabling unwanted Basic Auth for the proxy hosts using this Access List.

Expected behavior

The Authorization fields should remain completely blank when editing or adding IP addresses in the Access Rules tab, unless credentials are explicitly entered by the user.
Saving an Access List without opening or modifying the Authorization tab must not silently attach saved browser credentials or enable HTTP Basic Auth for the associated proxy hosts.

Suggested Solutions / Fixes:

• Set autocomplete="off" or autocomplete="new-password" on the Username and Password input fields in the Authorization tab.
• Use hidden dummy input fields (<input type="text" style="display:none"> and <input type="password" style="display:none">) at the top of the modal form to trap the browser's autofill mechanism.
• Programmatically force-clear the Authorization state on modal initialization unless the user explicitly toggles the Authorization section.

Screenshots

The discussion #3613 screenshots are up to date and represent the exact same UI issue.

Operating System

NPM Host OS: Debian 12 (6.1.0-53-amd64 kernel)
Customer OS: Windows 11 Pro 25H2 (Chrome 152.0.7977.83 / Firefox 155.0.1)

Additional context

Tested on Chrome and Firefox with standard browser password managers enabled.