I have created a form purposed as a private service intake form that collects a bunch of information from one client. One of the fields is labeled “Device Passcode” The placeholder text is the same.
When the form is submitted, anything that was entered into the Device Passcode field shows up in the submitted form as this: (Removed)
I realize this is probably to prevent any abuse of the webflow form system, but I have not found any webflow documentation on this feature. I’m looking for any information that which could explain what exactly is being flagged or how I might be able to work around this.
Your theory is accurate in that this would open a vector for Webflow to be misused to host phishing attacks or other abuses.
Webflow disallows collection of sensitive information and will not enable users to transmit passwords in plain text format, which is the output of a Webflow form (plain text to email, and plain text in a table within your Webflow account).
A workaround would be to embed an external form service that allows for such collection, though most form services disallow for such collection (for good reason!).
There are plenty of custom-code options, though, which would set you up nicely to handle passcode collection securely.
I think a custom code option would be an ideal route for added security. Ultimately the receiver of the form submissions would need to access this sensitive field. @ctrav Can you recommend an example of a custom code solution for handling sensitive information?
However If there isn’t documentation from webflow on this feature (i haven’t found it) i think there should be. If I can request webflow support chime in here to provide any additional guidance or best practices? (No other posts or documentation on this feature that I can find!)
We actually receive this inquiry in support quite often now. But anytime you use the terms; pass, code, password, etc. all submissions will be scrubbed for security purposes, when using our forms.
You can use a 3rd party form submission for this type of data request though.
The reason for this is because we have reserved the password entry/submission for our own user-systems feature we are currently building as introduced in our WWT last August and in yesterday’s Quarterly event.
Please let me know if you have any other questions,
Have a Great Day and Happy Designing,
~ Brandon M.
Webflow Customer Technical Support Team
Thank you Brandon and the Webflow team! I do understand the reasoning behind this behaivor. This answers my question, and I have found a suitable workaround. Thanks again to everyone for your responses.
I’ll also be checking out this new user systems feature!