You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tapestry.apache.org by Christine <my...@christine.nl> on 2015/08/03 20:04:27 UTC
prefilling password
I have a form with a password field. It gets pre-filled with a
previously used password string. How can I prevent the browser and/or
Tapestry from putting a value in the password field?
dagdag
Christine
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: prefilling password
Posted by Lance Java <la...@googlemail.com>.
I've always considered this a bit of a security flaw. Using the javascript
console you can show the password in plain text.
Eg:
alert(document.getElementById('password').value);
On 3 Aug 2015 21:13, "Thiago H de Paula Figueiredo" <th...@gmail.com>
wrote:
> On Mon, 03 Aug 2015 15:04:27 -0300, Christine <my...@christine.nl>
> wrote:
>
> I have a form with a password field. It gets pre-filled with a previously
>> used password string. How can I prevent the browser and/or Tapestry from
>> putting a value in the password field?
>>
>
> This is actually done by the browser, not Tapestry, which never prefills
> password fields. I believe you should add autocomplete="false" to your form
> or password field. More information here:
> https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion
> .
>
> --
> Thiago H. de Paula Figueiredo
> Tapestry, Java and Hibernate consultant and developer
> http://machina.com.br
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>
Re: prefilling password
Posted by Thiago H de Paula Figueiredo <th...@gmail.com>.
On Mon, 03 Aug 2015 15:04:27 -0300, Christine <my...@christine.nl> wrote:
> I have a form with a password field. It gets pre-filled with a
> previously used password string. How can I prevent the browser and/or
> Tapestry from putting a value in the password field?
This is actually done by the browser, not Tapestry, which never prefills
password fields. I believe you should add autocomplete="false" to your
form or password field. More information here:
https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion.
--
Thiago H. de Paula Figueiredo
Tapestry, Java and Hibernate consultant and developer
http://machina.com.br
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
For additional commands, e-mail: users-help@tapestry.apache.org
Re: prefilling password
Posted by Stephen Nutbrown <st...@gmail.com>.
Hi,
I think it will only prefill it if the password is persisted. I would think
the best solution is not to persist the password with @Persist.
Thanks,
Steve
On 3 August 2015 at 19:04, Christine <my...@christine.nl> wrote:
>
> I have a form with a password field. It gets pre-filled with a previously
> used password string. How can I prevent the browser and/or Tapestry from
> putting a value in the password field?
>
> dagdag
> Christine
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tapestry.apache.org
> For additional commands, e-mail: users-help@tapestry.apache.org
>
>