Browser vulnerability storing username password from login.fcc with Autocomplete in CA Access Gateway (SPS)

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign-On
• SITEMINDER

Issue/Introduction

How to disable Autocomplete function on the login.fcc HTML Forms, to prevent the Web Browsers from storing the username and the passwords from the CA Access Gateway (SPS) Agent protected sites?

Is the Autocomplete can be handled with the current .fcc files on the system?

Cause

The Web Agent /samples/secureforms/login.fcc already prevents that behavior, as it has AUTOCOMPLETE="off" for the name and password.

But, the secureforms directory cannot be found anymore on 12.8.x installation of the CA Access Gateway (SPS).

The secureforms directory is only available on the Web Agent.

Resolution

Get the /samples/secureforms/login.fcc from a Web Agent and install it on the CA Access Gateway (SPS).

Or use a simple HTML code to be added, that should prevent the browsers from using Autocomplete on the HTML Forms (1), like:

   <input type="password" name="PASSWORD" size="30" style="margin-left: 1px" AUTOCOMPLETE="off">

Note, these changes are fully on your responsibility.

The login.fcc can be modified to also meet specific needs, as long as the SiteMinder Agent functionality is not negatively impacted.

Additional Information

1. Disable HTML Form Input Autocomplete and Autofill