Insecure Login Form
Overview
Login forms must be secured from several angles:
- HTTP form submission: Credentials transmitted in cleartext
- Password autocomplete enabled: Stored credentials can be accessed by XSS
- No CSRF protection: Login form submissions forged from other origins
- Remember credential prompt disabled: Should be disabled in some contexts
Remediation
- Serve login forms and POST targets exclusively over HTTPS
- Add
autocomplete="new-password"to prevent unintended credential storage - Add CSRF tokens to login forms