# Insecure Login Form

> Detects login forms served over HTTP, with autocomplete enabled for password fields, or without CSRF protection.

- Skill: `zakirkun/insecure-login-form` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add zakirkun/insecure-login-form`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zakirkun/insecure-login-form/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zakirkun (https://skillmd.com/u/zakirkun)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zakirkun/insecure-login-form

---


# Insecure Login Form

## Overview
Login forms must be secured from several angles:
1. **HTTP form submission**: Credentials transmitted in cleartext
2. **Password autocomplete enabled**: Stored credentials can be accessed by XSS
3. **No CSRF protection**: Login form submissions forged from other origins
4. **Remember credential prompt disabled**: Should be disabled in some contexts

## Remediation
- Serve login forms and POST targets exclusively over HTTPS
- Add `autocomplete="new-password"` to prevent unintended credential storage
- Add CSRF tokens to login forms