-
Notifications
You must be signed in to change notification settings - Fork 14.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Set Autocomplete Off on Login Form - Main #44929
Conversation
5d7dbbf
to
e19e417
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I actually am not a fan that autocomplete is turned off just in sake of "security" as usability suffers with this. In my view this is more convenience and is something to be considered on a shared PC... but anyway.
Small issue in static check, can you resolve this? Best is to use pre-commit locally then you can catch it before submitting to CI |
Yea I can see that. Perhaps maybe next iteration can turn this into a Webserver environment variable/Airflow Configuration setting? |
Right on, thanks for the heads up. All fixed now. |
* #44019 - Set autocomplete to off for username and password login form * fixed static check (cherry picked from commit c77c7f0) Co-authored-by: James Regan <[email protected]>
* apache#44019 - Set autocomplete to off for username and password login form * fixed static check (cherry picked from commit c77c7f0) Co-authored-by: James Regan <[email protected]>
* #44019 - Set autocomplete to off for username and password login form * fixed static check (cherry picked from commit c77c7f0) Co-authored-by: James Regan <[email protected]>
* #44019 - Set autocomplete to off for username and password login form * fixed static check (cherry picked from commit c77c7f0) Co-authored-by: James Regan <[email protected]>
* apache#44019 - Set autocomplete to off for username and password login form * fixed static check
closes: #44019
Updated main Javascript to apply autocomplete="off" to both username and password inputs on login page. This will help prevent the browser from providing hints for the username (and password), as requested in the Issue.
Based on Flask-AppBuilder source code, i.e. https://github.com/dpgaspar/Flask-AppBuilder/tree/master/flask_appbuilder/templates/appbuilder/general/security (see login_db.html and login_ldap.html), this should work for both AUTH_DB (default) and AUTH_LDAP authentication, since they both apparently use the same HTML elements in the form.