Require autocomplete attribute on password inputs

Rule ID:
autocomplete-password
Category:
Security
Standards:
-

Password input fields should have a proper autocomplete attribute to control browser password autofill behavior.

Browsers and password managers often ignore autocomplete="off" for password fields and autofill them anyway. This can lead to unexpected behavior where users unknowingly submit autofilled passwords for unrelated fields.

This rule ensures that:

  1. All <input type="password"> elements have an autocomplete attribute
  2. The autocomplete attribute is not set to "off"
  3. Optionally, the autocomplete value matches a configured preferred value

See HTML specification for more information about autocomplete tokens.

Rule details

Examples of incorrect code for this rule:

<input type="password">
<input type="password" autocomplete="off">
error: <input type="password"> is missing required "autocomplete" attribute (autocomplete-password) at inline:1:2:
> 1 | <input type="password">
    |  ^^^^^
  2 | <input type="password" autocomplete="off">


error: <input type="password"> should not use autocomplete="off" (autocomplete-password) at inline:2:38:
  1 | <input type="password">
> 2 | <input type="password" autocomplete="off">
    |                                      ^^^


2 errors found.

Examples of correct code for this rule:

<input type="password" autocomplete="new-password">

Options

This rule takes an optional object:

{
  "preferred": null
}

preferred

When set, this option requires all password inputs to use a specific autocomplete value.

Examples of incorrect code with { "preferred": "new-password" }:

<input type="password" autocomplete="current-password">
error: <input type="password"> should use autocomplete="new-password" (autocomplete-password) at inline:1:38:
> 1 | <input type="password" autocomplete="current-password">
    |                                      ^^^^^^^^^^^^^^^^


1 error found.

Examples of correct code with { "preferred": "new-password" }:

<input type="password" autocomplete="new-password">

Version history