feat(password-reveal): set spellcheck attribute to false (#377)

automatically set spellcheck attribute to false to protect users' passwords from being sent to remote spellcheck services
ministryofjustice · Sep 20, 2022 · 04a8ee1 · 04a8ee1
1 parent 9880b1f
commit 04a8ee1
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/docs/components/password-reveal.md b/docs/components/password-reveal.md
@@ -9,4 +9,6 @@ title: Password reveal
 
 ## When to use
 
-Use the password reveal component to let users check their password safely.
+Use the password reveal component to let users check their password safely.
+
+This component automatically sets the `spellcheck` attribute to `false` to prevent users' passwords being stored in their browsers.
diff --git a/src/moj/components/password-reveal/password-reveal.js b/src/moj/components/password-reveal/password-reveal.js
@@ -7,6 +7,7 @@ MOJFrontend.PasswordReveal = function(element) {
   }
 
   $el.data('moj-password-reveal-initialised', true);
+  $el.attr('spellcheck', 'false');
 
   $el.wrap('<div class="moj-password-reveal"></div>');
   this.container = $(this.el).parent();