Question

I have a simple Login page made with JSF 2.0. Usually in every login page the web browser proposes to the user to save his username a password.

I saw in Oracle’s web site where user must authenticate that when I enter my username and password the browser do not ask me do I want to save my username and password. Maybe there is a way to disable this from the code of the login page.

Is this possible?

Answer 1

You basically need to add autocomplete="off" attribute to the HTML <form> element. However, this attribute is not supported on the <h:form>. It’s only supported on the individual <h:inputText> and <h:inputSecret> components.

So, this should do:

<h:form>
    <h:inputText value="#{auth.username}" required="true" autocomplete="off" />
    <h:inputSecret value="#{auth.password}" required="true" autocomplete="off" />
    <h:commandButton value="Login" action="#{auth.login}" />
    <h:messages />
</h:form>

The new autocomplete attribute on <h:form> is scheduled for JSF 2.2. See also JSF spec issue 418.

Or, if you’re using container managed login with j_security_check which requires a plain vanilla HTML <form> anyway, then just add it in there:

<form action="j_security_check" method="post" autocomplete="off">
    <input type="text" name="j_username" />
    <input type="password" name="j_password" />
    <input type="submit" value="Login" />
</form>

See also:

• <h:inputText> tag documentation (mentions autocomplete attribute)
• <h:inputSecret> tag documentation (mentions autocomplete attribute)