Summary
The login/authentication flow allows browsers (Google Chrome in this case) to automatically detect the username and password fields and prompt the user to save credentials. This behavior occurs because the form either does not explicitly define appropriate autocomplete attributes or relies on default browser behavior.
While this is not a direct vulnerability by itself, improper or missing autocomplete configuration can result in unintended credential storage on shared or untrusted devices, increasing the risk of credential exposure.
Description
During testing, after entering valid account credentials, Google Chrome displayed a "Save password?" prompt, offering to store the username and password in the browser's password manager.
This indicates that the authentication fields are recognized as login credentials without explicit control over browser autofill behavior.
Steps to Reproduce
Open:
https:
Navigate to the login page (if not already authenticated).
Enter valid credentials.
Submit the login form.
Observe that Chrome displays the Save Password dialog.
Proof of Concept
Observed behavior:
Browser: Google Chrome
Username field detected automatically
Password field detected automatically
Chrome prompts:
Save
Never
No Thanks
(Screenshot attached by researcher.)
Expected Result
Sensitive authentication fields should explicitly define appropriate autocomplete attributes according to the application's security requirements, for example:
Username:
autocomplete="username"
Password:
autocomplete="current-password"
If the application intentionally wants to discourage browser credential storage on sensitive environments, additional controls may be considered where appropriate.
Actual Result
The browser automatically detects credentials and offers to permanently save them.
Security Impact
Potential risks include:
Credentials being stored on shared or public computers.
Unauthorized users gaining access to saved credentials if the browser profile is compromised.
Increased exposure when devices are shared among multiple users.
Users may unintentionally save credentials on untrusted systems.
Business Impact
Increased likelihood of account compromise on shared devices.
Reduced protection for users handling sensitive notes or personal information.
May not align with organizational security best practices for authentication flows.
Recommendation
Explicitly configure the autocomplete attribute on authentication fields.
Review whether browser password saving is intended for the application.
Follow current HTML autocomplete best practices for login forms.
Document expected browser behavior for users accessing the application from public or shared devices.
CWE
CWE-524: Use of Cache Containing Sensitive Information
OWASP
OWASP ASVS 4.0
V3 – Session Management
V2 – Authentication (Autocomplete and credential handling best practices)