documentation_complete: true

prodtype: osp7

title: 'Check-Dashboard-07: Is password_autocomplete set to False?'

description: |-
    Common feature that applications use to provide users a convenience is to cache the password locally in the browser (on the client machine) and having it ‘pre-typed’ in all subsequent requests. While this feature can be perceived as extremely friendly for the average user, at the same time, it introduces a flaw, as the user account becomes easily accessible to anyone that uses the same account on the client machine and thus may lead to compromise of the user account.
    <br />
    <br />
    Pass: If value of parameter password_autocomplete in /etc/openstack-dashboard/local_settings is set to off.
    <br />
    <br />
    Fail: If value of parameter password_autocomplete in /etc/openstack-dashboard/local_settings is set to on.

rationale: ""

severity: unknown
