security issue

[hoyin2013]

Hi,team,we found some security issues via security software as the follow.hope can fix it on  next version.thx. 

Name	Synopsis	Description	Solution	See Also
Missing Content Security Policy	Missing Content Security Policy	Content Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.No CSP header has been detected on this host. This URL is flagged as a specific example.	Configure Content Security Policy on your website by adding 'Content-Security-Policy' HTTP header or meta tag http-equiv='Content-Security-Policy'.	https://developer.mozilla.org/en-US/docs/Web/HTTP/CSPhttps://csp-evaluator.withgoogle.com/https://content-security-policy.com/https://developers.google.com/web/fundamentals/security/csp/https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
Password Field With Auto-Complete	Password Field With Auto-Complete	In typical form-based web applications, it is common practice for developers to allow autocomplete within the HTML form to improve the usability of the page. With autocomplete enabled (default), the browser is allowed to cache previously entered form values.For legitimate purposes, this allows the user to quickly re-enter the same data when completing the form multiple times.When autocomplete is enabled on either/both the username and password fields, this could allow a cyber-criminal with access to the victim's computer the ability to have the victim's credentials automatically entered as the cyber-criminal visits the affected page.Scanner has discovered that the affected page contains a form containing a password field that has not disabled autocomplete.	The autocomplete value can be configured in two different locations.The first and most secure location is to disable the autocomplete attribute on the <form> HTML tag. This will disable autocomplete for all inputs within that form. An example of disabling autocomplete within the form tag is <form autocomplete=off>.The second slightly less desirable option is to disable the autocomplete attribute for a specific <input> HTML tag. While this may be the less desired solution from a security perspective, it may be preferred method for usability reasons, depending on size of the form. An example of disabling the autocomplete attribute within a password input tag is <input type=password autocomplete=off>.	https://www.owasp.org/index.php/Testing_for_Vulnerable_Remember_Password_(OTG-AUTHN-005)
Permissive Content Security Policy Detected	Permissive Content Security Policy Detected	Content Security Policy (CSP) is a web security standard that helps to mitigate attacks like cross-site scripting (XSS), clickjacking or mixed content issues. CSP provides mechanisms to websites to restrict content that browsers will be allowed to load.One or several permissive directives have been detected. See output for more details.	The following directive configurations can be applied to have a safe content security policy:- 'frame-ancestors' should be set to 'none' to avoid rendering of page in ,