🎓 AutoUni — Neptun & eduID Login Auto-Fill A Firefox browser extension that auto-fills your Neptun and eduID credentials when you visit the login page. Intended for private, convenience use at your own risk — see the Security & Privacy section below. Features

Neptun auto-fill — When you visit https://neptun.bme.hu/hallgatoi/login, the extension automatically fills your Neptun code and password, then clicks the login button
eduID auto-fill — When you visit https://edu.vik.bme.hu/login/index.php, it clicks the eduID button, follows the redirect to the BME IDP, fills your eduID credentials, and submits
SPA-aware — Detects URL changes in Angular (Neptun) using the Navigation API and triggers auto-fill on in-place navigation
Angular-ready — Fires input and change events so Angular Material detects the values
Persistent credentials — Stored in browser's chrome.storage.local

How It Works Neptun Flow

You navigate to https://neptun.bme.hu/hallgatoi/login
The content script detects the login page (on load and via Navigation API)
It waits up to 10 seconds for the form elements to appear in the DOM
Once found, it fills your Neptun code and password, then clicks the login button

eduID Flow

You navigate to https://edu.vik.bme.hu/login/index.php
The content script clicks .login-identityprovider-btn to redirect to the IDP
On the IDP page (idp.bme.hu), it fills #username and #password with your eduID credentials
It clicks the submit button

Supported Sites

Neptun: https://neptun.bme.hu/hallgatoi/login ✅ active
eduID / BME IDP: https://edu.vik.bme.hu/login → https://idp.bme.hu/ ✅ active

Security & Privacy Encryption Passwords are encrypted at rest using AES-GCM with a hardcoded key baked into the source code (crypto.js). The encryption is applied when you save settings in the Options page, and decrypted automatically by the content scripts before filling forms. Because the key is static and publicly visible in the source, the encryption provides obfuscation rather than true cryptographic security — it prevents casual inspection of stored credentials but can be reversed by anyone who can read your extension's storage. Use at Your Own Risk This extension is designed for convenience on a personal, private device where no other users have access. It is not suitable for shared or public computers.

If an attacker gains file-system or browser storage access to your machine, they can decrypt your stored passwords. However, at that point they would also be able to grab browser cookies, session tokens, and do far worse damage. In practice, the encryption provides a reasonable barrier against casual credential exposure (e.g., someone borrowing your unlocked laptop for a few minutes), but it should not be relied upon as a genuine security control.

What's Protected

Credentials are stored locally in your browser's chrome.storage.local — never sent to any external server
Only the relevant domains are included in the extension permissions
The extension runs entirely in the browser — no cloud services

What's Not Protected

The encryption key is hardcoded in plain text in crypto.js — anyone with source access knows it
If the browser's storage is accessible (e.g., via file system access or a malicious extension), passwords can be decrypted
Username fields are stored in plaintext (no encryption applied to usernames)
Credentials are stored unencrypted on the server-side if browser sync is enabled (though storage.local typically doesn't sync)

Latest version

Version 1.5.0

Older versions

Version 1.3.0