1273716 - Consider implementing write-only <input> support

Status: NEW

(Core :: DOM: Security, enhancement, P5)

Description

[Matthew N. [:MattN]]

Either via CSP and/or an attribute on a <input> or <form>, we should provide a way for authors to prevent page access to sensitive form field values such as credit card and password ones to prevent leaks to attackers.

Proposal email: https://lists.w3.org/Archives/Public/public-whatwg-archive/2014Oct/0181.html
Draft spec: https://mikewest.github.io/credentialmanagement/writeonly/

Comment 1

[Matthew N. [:MattN]]

I think support for <input writeonly> would be a fine first-step if we want to reduce the scope of what's in the current draft since it's the most common element used for these types of sensitive fields.

Comment 2

[Matthew N. [:MattN]]

A simple way to help drive adoption would be to add developer console warnings when type=password or autocomplete=cc-number/cc-csc/current-password/new-password fields are lacking @writeonly.