search

18F / dol-whd-14c

The 14(c) system will become a modern, digital-first service. Applicants will be provided an intuitive online experience, guiding them through the information needed to complete their application correctly.
Other
16 stars 17 forks source link

WebInspect scan: Low: Privacy Violation: Autocomplete #799

Open NathayaMDOL opened 6 years ago

NathayaMDOL commented 6 years ago

Fix: From the web application perspective, the autocomplete can be turned at the form level or individual entry level by defining the attribute AUTOCOMPLETE="off".

< FORM AUTOCOMPLETE = "off" > : < /FORM >

https://technet.microsoft.com/en-us/windows/ms533032(v=vs.60)

NathayaMDOL commented 6 years ago

Not sure if this issue needs to apply to all input fields or just only password field. Also I have found AUTOCOMPLETE="off" has no longer support on IE and Edge but works fine on Chrome68. Needs to discuss with the team. References: https://developer.microsoft.com/en-us/microsoft-edge/platform/issues/9847360/

autocomplete off and fields still autopopulate microsoft edge development

NathayaMDOL commented 6 years ago

This issue has been pushed to Dev. Fixed: set autocomplete off on HTML form and field Branch: whd-aqa-799-nmankong-autocomplete-off

NathayaMDOL commented 6 years ago

Note: I have tried to use jQuery (code below) before but the field still auto filling. • $(document).ready(function () { $("input").attr("autocomplete", "off"); }); • $('form').attr('autocomplete','off');

So I just applied to each page directly and tested on VM. Some input didn’t work with autocomplete = “off”, but it worked with autocomplete = “nofill”. Chrome was working fine but not IE. After deployed to Dev, somehow it’s not working properly. Maybe browser issue! "https://github.com/ng-bootstrap/ng-bootstrap/issues/2194" My point is it’s doesn’t matter apply directly to each page or global, it’s still not working. Unless we want to clean the code then should be in global or find another way. Any thought/recommended?