Auto Complete Enabled Password Input

Description

Enabling autocomplete for password input fields allows browsers to save and autofill sensitive information, such as passwords. This poses a security risk, particularly on shared or public computers, where unauthorized users may access saved credentials.

Recommendation

Disable autocomplete for sensitive form inputs by adding the attribute autocomplete="off" to password input fields. This prevents browsers from saving and autofilling passwords, enhancing security.

References

• CWE-16
• Mozilla Developer Network (MDN) Web Docs: autocomplete attribute
• OWASP 2021-A5
• OWASP: Secure Coding Practices Quick Reference Guide