LI81310: USERNAME/PASSWORD AUTOFILLING IN INVOKE POLICY FIELDS.

APAR status

• Closed as program error.

Error description

• In the API Connect HTML page, it is getting two IDs used by
  Chrome's user/password manager
  
  The main issue seems to be that
  API connect is taking the same id used by the browser.
  We need
  to take advantage of saved user/passwords on the browser and we
  believe this should not cause security issues, but somehow this
  is happening.
  Also, we just tested this issue with the fix pack
  9, and the problem persists, it takes the password from the
  browser and puts it in the yaml file.
  

Local fix

• This can be fixed using autocomplete="new-password". Reasoning
  is described here:
  https://developer.mozilla.org/en-US/docs/Web/Security/Secu
  ring_your_site/Turning_off_form_autocompletion#The_autocomplete_
  attribute_and_login_fields
  

Problem summary

• <span style="background-color:rgb(255, 255,
  255)">USERNAME/PASSWORD AUTOFILLING IN INVOKE POLICY
  FIELDS.</span>
  

Problem conclusion

• Fixed in 2018.4.1.10
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels

• R18X PSY

     UP