Autocomplete and Remember Password Enabled
Last updated
Was this helpful?
Last updated
Was this helpful?
Autocomplete is Enabled in one or more of the form fields which might contain sensitive information like "username", "credit card" or "CVV".In case if this this autocompletion option is not enabled when the user chooses to save, data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information.This is especially important if the application is commonly used in shared computers, such as cyber cafes or airport terminals.
when you have a login page in your application ,right click on that then go for inspect elements , then have your pointer arrow at either user name or password and you will be shown a input fields for that particular options , the below screenshot can tell you clearly about that issue.
From the above screenshot you can see that clearly there is no autocomplete option in it.this is how you can check for this autocomplete option.
Add the attribute autocomplete="off" to the form tag or to individual "input" fields. Find all instances of inputs that store private data and disable autocomplete. Fields which contain data such as "Credit Card" or "CCV" type data should not be cached. You can allow the application to cache usernames and remember passwords; however, in most cases this is not recommended.
Re-scan the application after addressing the identified issues to ensure all of the fixes have been applied properly.
