sapiens/MvcPowerTools — pull request #1 by ventaur (2014-07-09 03:24:08+00:00)
Title: Ensure provided Html conventions for passwords do not output editor value by default

If you POST a form with a password field and errors, typically with a PRG cycle, the form is repopulated with the submitted values. This creates a security issue for password fields. SSL mitigates most of this risk, but the password input's value can still be viewed via page source.

ASP.NET MVC's PasswordFor extension method prevents the editor's value from populating. This pull request mimics that functionality for the built-in HTML conventions offered by MPT.

PopulatePasswordAttribute is provided as a way to override this new default functionality, if the developer **really** wants to bypass the security benefits the default convention now provides. For example: http://www.wduffy.co.uk/blog/repopulate-html-passwordfor-on-validation-errors/.