Insecure Login Form

Detects login forms served over HTTP, with autocomplete enabled for password fields, or without CSRF protection.

zakirkun Updated

File contents

Insecure Login Form

Overview

Login forms must be secured from several angles:

  1. HTTP form submission: Credentials transmitted in cleartext
  2. Password autocomplete enabled: Stored credentials can be accessed by XSS
  3. No CSRF protection: Login form submissions forged from other origins
  4. Remember credential prompt disabled: Should be disabled in some contexts

Remediation

  • Serve login forms and POST targets exclusively over HTTPS
  • Add autocomplete="new-password" to prevent unintended credential storage
  • Add CSRF tokens to login forms

zakirkun/ice-tea/tree/main/skills/auth/insecure-login-form commit c0518ff200

Frequently asked questions

npx skillmds@latest add zakirkun/insecure-login-form