documentation_complete: true

title: 'Disable User Ability To Autofill Passwords'

description: |-
    Firefox automatically allows users to save passwords to be auto-filled
    into password forms. This can be disabled by setting
    <tt>signon.prefillForms</tt> to <tt>false</tt>.

rationale: |-
    While on the internet, it may be possible for an attacker to view
    the saved password files and gain access to the user's accounts on
    various hosts.

severity: medium

identifiers:
    cce: ""

references:
    disa: ""
    nist: ECSC-1
    stigid: DTBF150

ocil_clause: 'it is not disabled'

ocil: |-
    To verify that password autofill is disabled,
    run the following command:
    <pre>$ grep 'signon.prefillForms' <i>FIREFOX_INSTALL_DIR</i>/*.cfg</pre>
    The output should return:
    <pre>lockPref("signon.prefillForms", false);</pre>
