-
Type: Task
-
Status: Resolved
-
Priority: Minor
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: 9.10-HF44, 10.10-HF27, 11.1, 2021.0
-
Component/s: Login Page
Some security tools require the login/password fields of a login page to have autocomplete="off".
With most browsers this is not a usability issue because they still detect these fields and make them usable with password managers.
This obsolete requirement from security tools is often due to an incorrect reading of https://wiki.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005) and in particular forgetting to read the part that says:
Since early 2014 most major browsers will override any use of autocomplete="off" with regards to password forms and as a result previous checks for this are not required and recommendations should not commonly be given for disabling this feature.