Description of problem: Customer wants to know how to disable password auto-completion in Horizon. Is it possible to do it manually by modifying the Horizon container image as a workaround ? I didn't see anyway in the hardening guide. Version-Release number of selected component (if applicable): 16.2 How reproducible: Everytime Steps to Reproduce: 1. 2. 3. Actual results: Can't do it Expected results: Be able to do it Additional info:
{% block login_body %} {% comment %} These fake fields are required to prevent Chrome v34+ from autofilling form. {% endcomment %} {% if HORIZON_CONFIG.password_autocomplete != "on" %} <div class="fake_credentials" style="display: none"> <input type="text" name="fake_email" value="" /> <input type="password" name="fake_password" value="" /> </div> {%endif%}
[dhill@knox horizon]$ grep -r password_autocomplete * conf/default.py: 'password_autocomplete': 'off', templates/auth/_login_form.html: {% if HORIZON_CONFIG.password_autocomplete != "on" %} templates/auth/_password_form.html: {% if HORIZON_CONFIG.password_autocomplete != "on" %}
What is the browser being used ?
Maybe https://review.opendev.org/c/openstack/horizon/+/880364 is enough ?
This setting should do it: https://docs.openstack.org/horizon/latest/configuration/settings.html#password-autocomplete
Hello David. I would like to verify the bugfix but from the description I am not sure what exactly I should test. Could you please specify this bug (and how to reproduce it) more precisely? Alternatively, add whether the issue is only in some specific browser. Thank you.