0

How do I restrict the browsers from remebering the password?

asked 2014-05-14 10:52:23 +0800

saikrishnap gravatar image saikrishnap
0

I would like to restrict the browsers from asking to remember the password for the application. I have done the below changes in the login page

<zk xmlns:h="http/www.w3.org/1999/xhtml" xmlns:ca="client/attribute">
    <h:form action="j_spring_security_check" method="post">
        <textbox type="password" ca:autocomplete="off" />
    </h:form>
</zk>

This works fine in Firefox and IE8 but not working in Chrome.

I tried to specify the ca:autocomplete="off" for form element but didn't worked.

Thanks in advance

delete flag offensive retag edit

7 Replies

Sort by ยป oldest newest

answered 2014-07-25 08:30:48 +0800

mady gravatar image mady
1

this is working fine with IE8 but not with mozilla and crome

can i find any zscrpt to do the same with mozilla and crome also

link publish delete flag offensive edit

answered 2014-12-15 15:23:14 +0800

blarouche gravatar image blarouche
1

Hi,

This doesn't work with IE11, Chrome and Mozilla. What is the way to restrict the browsers from asking to remember the password? Thanks

link publish delete flag offensive edit

answered 2017-06-09 05:50:15 +0800

Alam gravatar image Alam
1 1

updated 2017-06-09 06:00:03 +0800

Just use the textbox like this.It will eliminate the browser save password functionality. <textbox id="pwdtb" width="300px" type="password" xmlns:w="client" readonly="true"> <attribute w:name="onBlur"> <attribute w:name="onFocus"> </textbox>

link publish delete flag offensive edit

answered 2017-06-09 06:10:12 +0800

jins gravatar image jins
1 1

READONLY TEXTBOX NEVER SHOWS THE BROWSER SAVE PASSWORD FUNCTIONALITY,

link publish delete flag offensive edit

answered 2017-06-10 12:43:10 +0800

Darksu gravatar image Darksu
1991 1 4

Hello jins,

Basically when the new form is initiated you can clear the values of the textboxes.

Best,

Darksu

link publish delete flag offensive edit

answered 2017-06-12 09:20:08 +0800

jins gravatar image jins
1 1

updated 2017-06-12 09:25:18 +0800

Hello Darksu

        This is not working in chrome browser
link publish delete flag offensive edit

answered 2017-06-13 02:36:53 +0800

cor3000 gravatar image cor3000
4406 2 7
ZK Team

updated 2017-06-13 02:37:32 +0800

In case you need some commonly accepted opinions check the OWASP website:

https://www.owasp.org/index.php/TestingforVulnerableRememberPassword_%28OTG-AUTHN-005%29

Which states:

Since early 2014 most major browsers will override any use of autocomplete="off" with regards to password forms and as a result previous checks for this are not required and recommendations should NOT commonly be given for disabling this feature.

Maybe that's some reasoning for your customer to consider. Also it might be time to upgrade their browsers... I'd argue IE8 (on WinXP?) is the greater security risk here to worry about.

Robert

link publish delete flag offensive edit
Your reply
Please start posting your answer anonymously - your answer will be saved within the current session and published after you log in or create a new account. Please try to give a substantial answer, for discussions, please use comments and please do remember to vote (after you log in)!

[hide preview]

Question tools

Follow
4 followers

RSS

Stats

Asked: 2014-05-14 10:52:23 +0800

Seen: 47 times

Last updated: Jun 13 '17

Support Options
  • Email Support
  • Training
  • Consulting
  • Outsourcing
Learn More