Question

For <input type="password" />

In ASP.net:

PasswordField.text = RawPasswordString;

This doesn’t work, but can be circumvented with:

PasswordField.Attributes.Add("value", RawPasswordString);

I’m doing this so when the registration form fails, they don’t need to re-enter their passwords if they were valid, this annoys me no end on some websites. We have a CAPTCHA field that needs server validation, so when this fails (the most likely field to fail), I don’t want them to enter a correct one, but then the passwords fail because they cleared, meaning they have to enter the CAPTCHA again.

What are the security reasons, and if this page is on HTTPS is that OK? If it’s on HTTPS with nocaching, what else should I be aware of?

Answer 1

Absolutely not. Browsers still can cache the result and someone can look at the cache and take the password.