Password autocompletion set to off on login page

[datta90]

Apache Airflow version

Other Airflow 2 version (please specify below)

If "Other Airflow 2 version" selected, which one?

2.8.1

What happened?

my company vulnerability scanning tool has reported that the login page of airflow should have autocomplete field set to off

What you think should happen instead?

the autocomplete parameter should be set to off in the password field

How to reproduce

simply doing a curl request on the airflow url with /login appended will reveal a html page where we see that the password field does not have autocomplete set

for eg curl -X GET http://airflow:8080/login

Operating System

rhel 8.9

Versions of Apache Airflow Providers

No response

Deployment

Virtualenv installation

Deployment details

using virtualenv to install airflow

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template! If you are willing to raise PR to address this issue please do so, no need to wait for approval.

[potiuk]

Feel free to work on that if you want @datta90 - otherwise I marked it as a good first issue - hopefully someone will pick it up and implement it if you will not want, but if you want to get it fixed faster, contributing PR is a most effective way.

Also note - generally speaking if you are reporting security issue, you should NEVER use public issues. This one - luckily - is not "really" security issue, certainly not a CVE worthy one, so it's quite ok to put in public, but generally speaking approaching security issues in a "responsible" way - you should follow our security policy to report such issues. And this is the same for all projects out there, so you might consider in the future finding out and following security policy when you are reporting security-related issues.

[datta90]

hi team,

@jmelot patch fixed this issue for me. thank you so much . i am marking this as closed now

[rajeshjagmohan]

@datta90 How did you patch fix this issue ? Did you create build using @jmelot change ? it seems this change is still not merged .
FYI : @potiuk

[datta90]

i directly changed in the source code of flask_appbuilder as shown by @jmelot

[rajeshjagmohan]

Thanks Datta

…

On Sat, 2 Nov 2024, 21:42 Datta, ***@***.***> wrote: i directly changed in the source code of flask_appbuilder as shown by @jmelot <https://github.com/jmelot> — Reply to this email directly, view it on GitHub <#40125 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BLKGEVAYKK7KG5ZWFREZPFDZ6T2WBAVCNFSM6AAAAABI7BSDXWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDINJTGAZTINJZGU> . You are receiving this because you commented.Message ID: ***@***.***>