🐝 Bee-ing a Tester: I found a bug …honey!. “Autocomplete: Security Loophole”. Bug #015: Username autocomplete allowed on login (should be blocked)

Severity:

High

Context:

The login form currently allows device autocomplete, which can fill the username automatically.
For security reasons, this should not be allowed, especially on shared devices.

Steps to Reproduce:

1. Open the login page on any device.
2. Use the device autocomplete to fill the username.
3. Enter the password manually.
4. Click Login.

Expected Result:

•  App blocks autocomplete for the username.
• Users must enter their username manually to prevent misuse.

Actual Result:

• App accepts the auto-filled username.
• User can log in without typing their username manually.

Impact:

• Security risk: credentials could be used by unintended users.
• Violates best practices for secure login.
• Could lead to unauthorized access on shared devices.

Suggested Fix:

 Set autocomplete=”off” for the username field.
– QA tests to ensure autocomplete cannot bypass login rules.
– Educate users about manual entry requirements on shared devices.

Lesson learnt:

“Convenience is great until it becomes a security hole!”

Let’s connect! I share common bugs, solutions, and QA tips regularly.