Should Password fields retain their values if a form does not pass validation?

I have a typical sign-up form with two password fields.

<form>
    <%= Html.TextBox("Email", null) %>

    <%= Html.Password("password", null) %>
    <%= Html.Password("confirmPassword", null) %>

    <input type='submit' />
</form>

If the form fails validation and is redisplayed, the text field retains its value but the password fields are always blank.

Why shouldn't the password fields retain their values? And more importantly, is there any reason I shouldn't override this behavior?

I feel like this behavior decreases usability, and would prefer password fields to behave the same way as textbox fields -- keeping the entered value when validation errors exist.

I'm using ASP.NET MVC, but this question pertains more to usability and security. I understand that what I'm seeing is expected behavior, and taking a look at the Password(...) method shows me that it explicitly ignores the value in ModelState.

Edit Report

You can send the value back on a regular input type=password field.

However, if you are using the .net input control, then it will clear the contents of value prior to sending the html back to the client.

The reason is simple: They wanted to limit the number of times in which a password was sent back and forth between the server and the browser. This helps limit exposure to some systems.(link)

Now, obviously, if you are using ssl then this isn't much of a consideration. Unforunately the vast majority of sites out there STILL don't use SSL and will happily send data back and forth in the clear. The more times that field travels between client and server, the more opportunities someone has of grabbing it ala FireSheep.

Bear in mind, this isn't to say that someone listening in on the whole conversation won't get it from the first post. However, consider it like a simple option to limit (not eliminate) the attack surface.

The next reason is that nearly every time sites show the password field to the user after a submit, it's because validation didn't pass. This could mean that the username and/or password is incorrect. Considering that password fields only display asterisks or dots to the user, there's no real reason to give it back to them.

Given that you never want to tell the user which of the credentials failed (ie: you do NOT want to say "password invalid" or "username invalid") AND that common users have no way of figuring out whether they fat fingered their entry, it's much better IMHO to clear BOTH.

All of that aside, you have a choice here. The standard is to blank it. Considering that this is the way the vast majority of sites work, do you really wa

answered 2011-06-30T21:02:48.180

Should Password fields retain their values if a form does not pass validation?

1 Answer

Your Answer