openstack/horizon — pull request #21 by odyssey4me (2013-02-05 09:51:10+00:00)
Title: Added autocomplete="off" to login form

The AUTOCOMPLETE attribute, which is used by web developers to indicate when web browsers should retain information relating to web forms, was not disabled on form input elements relating to passwords.

An attacker, who gains access to the computer, either locally or through some remote compromise, can capture the stored credentials. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

It is recommended that the AUTOCOMPLETE attribute on all sensitive forms should be disabled.