問題
company.security.login.form.autocomplete=false を設定して、ユーザーのログイン情報のオートコンプリートを無効にしても、ブラウザはユーザーがパスワードを保存したり、パスワードマネージャーを使用してパスワードのオートコンプリートやオートフィルを管理することを許可します。
解決
これは、主要なブラウザ開発チームからの autocomplete=off フォーム プロパティの合意の欠如や拒否が原因です。
Internet Explorer (developer blog):
[O]ne of the top user-complaints about our HTML Forms AutoComplete feature is "It doesn't work-- I don't see any of my previously entered text." When debugging such cases, we usually find that the site has explicitly disabled the feature using the provided attribute, but of course, users have no idea that the site has done so and simply assume that IE is buggy. In my experience, when features are hidden or replaced, users will usually blame the browser, not the website.
In this case, the team decided that keeping the user in control was of paramount importance.
Chrome (developer discussion):
I wanted to give a heads up that now, by default, Chrome ignores autocomplete='off' for password fields. This allows the password manager to give more power to users to manage their credentials on websites. It is the security team's view that this is very important for user security by allowing users to have unique and more complex passwords for websites.
Firefox (bug report that was marked as fixed):
autocomplete="off" does two things:
a) prevents us from automatically filling in already-saved data for forms/fields that have the attribute
b) prevents us from saving new data for forms/fields that have the attribute
This behavior is a concession to sites that think password managers are harmful and thus want to prevent them from being effective. In aggregate, I think those sites are generally wrong, and shouldn't have that much control over our behavior.
I think we should investigate removing support for autocomplete="off" entirely, or at least the portion of it that prevents us from saving passwords.
要約すると、これらの主要なブラウザ チームのいくつかは、オートコンプリートを無効にしたサイトによって、ユーザーが自分でパスワードを処理および管理する主体性を奪われたと感じました。 このため、この機能を削除または変更するという大きな動きがありました。 将来のリリースでは、company.security.login.form.autocomplete プロパティが Liferay から削除される予定です。