Detectify
Knowledge Base

Back to Knowledge Base

Support Center

Input Autocomplete

Last Updated: Jul 22, 2016 03:43PM CEST

Appears when you tell the browser to save your password. The browser stores completed form fields and password locally and automatically fill them when a user revisits the site again.

What can happen?

Password and other PII (personally identifiable information) theft. The browser automatically fills in the forms with previously provided information. If the attacker is able to modify the forms (by, say, an XSS flaw), a leak may take place.

Example

An attacker with local access could obtain the cleartext password just by changing the type of the input from password to text.

Combined with an XSS attack, this can be used to retrieve the victim's password remotely. If an attacker has discovered an XSS vulnerability on a website, they can wait for the victim's browser to automatically fill in the username and password in a login form. They can then easily steal the information by using, for example, the following JavaScript:

document.getElementsByID("passwordInputForm").value

...or by changing the action attribute when the form is being submitted.

Remediation

Set the autocomplete attribute to off on the input or on the whole form.

<input type="password" autocomplete="off"/>
<form autocomplete="off">

Note: Modern browsers will ignore the autocomplete="off" attribute.

support@detectify.com
https://cdn.desk.com/
false
desk
Loading
seconds ago
a minute ago
minutes ago
an hour ago
hours ago
a day ago
days ago
about
false
Invalid characters found
/customer/en/portal/articles/autocomplete