[ https://issues.apache.org/jira/browse/DRILL-8391?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
James Turton updated DRILL-8391: -------------------------------- Summary: Disable auto complete on the password field of web UI login forms (was: Disable auto complete on the password field of the web UI login forms) > Disable auto complete on the password field of web UI login forms > ----------------------------------------------------------------- > > Key: DRILL-8391 > URL: https://issues.apache.org/jira/browse/DRILL-8391 > Project: Apache Drill > Issue Type: Improvement > Components: Web Server > Affects Versions: 1.20.3 > Reporter: James Turton > Assignee: James Turton > Priority: Trivial > Fix For: 1.21.0 > > > In order to avoid triggering security scanners it is necessary to set > autocomplete = "off" on the password field in the web UI login form. This > change probably has no real world security benefit because > {quote}Even without a master password, in-browser password management is > generally seen as a net gain for security. Since users do not have to > remember passwords that the browser stores for them, they are able to choose > stronger passwords than they would otherwise. > For this reason, many modern browsers do not support {{autocomplete="off"}} > for login fields: > {quote} > * > > {quote}If a site sets {{autocomplete="off"}} for a > [{{<form>}}|https://developer.mozilla.org/en-US/docs/Web/HTML/Element/form], > and the form includes username and password input fields, then the browser > still offers to remember this login, and if the user agrees, the browser will > autofill those fields the next time the user visits the page. > {quote} * > {quote}If a site sets {{autocomplete="off"}} for username and password > [{{<input>}}|https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input] > fields, then the browser still offers to remember this login, and if the user > agrees, the browser will autofill those fields the next time the user visits > the page > {quote} > Excerpt taken from [this Mozilla Developer Network > page|https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion]. -- This message was sent by Atlassian Jira (v8.20.10#820010)