# Password fields and security? **URL:** \ **Category:** Rails\ **Created:** [January 24, 2006, 4:35pm UTC](https://www.ruby-forum.com/t/password-fields-and-security/96572 "2006-01-24T16:35:23Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\ **Post date:** [January 24, 2006, 4:35pm UTC](https://www.ruby-forum.com/t/password-fields-and-security/96572/1 "2006-01-24T16:35:23Z")
Hi all I wanted to ask why Rails’ password\_field helper uses the input password as default value when reloading a form because of errors? Isn’t this a potential security leak? On any other webs I’ve seen so far the password fields have to be filled in again after every reload of the site so the password doesn’t exist in plain text in the html code… What do you think about that? Greets, Josh ---
**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\ **Post date:** [January 24, 2006, 5:19pm UTC](https://www.ruby-forum.com/t/password-fields-and-security/96572/2 "2006-01-24T17:19:10Z")
Questionable whether this should be a framework thing or controlled by the programmer. I think I would rather have control over it then have it imposed on me. Better yet, maybe a password field could recognize a :reset\_on\_error attribute or something similar. Submit a patch and see how it goes. Bob S. ---
**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\ **Post date:** [January 24, 2006, 8:22pm UTC](https://www.ruby-forum.com/t/password-fields-and-security/96572/3 "2006-01-24T20:22:22Z")
And a single line in the controller: self.password = ‘’ is less simple? – – Tom M. ---
**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\ **Post date:** [January 24, 2006, 8:28pm UTC](https://www.ruby-forum.com/t/password-fields-and-security/96572/4 "2006-01-24T20:28:26Z")
On Jan 24, 2006, at 11:22 AM, Tom M. wrote: > And a single line in the controller: > > self.password = ‘’ > > is less simple? Oops, make that @object.password = ‘’ I hate it when I need to reply to myself. 🙂 – – Tom M. ---
**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\ **Post date:** [January 24, 2006, 8:52pm UTC](https://www.ruby-forum.com/t/password-fields-and-security/96572/5 "2006-01-24T20:52:33Z")
On 1/24/06, Tom M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > @object.password = ‘’ > > I hate it when I need to reply to myself. 🙂 Same level of simplicity. It just depends on whether or not you think that it belongs in the controller instead of the view. – James ---
**Author:** ![josh](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/45deac/32.png) [@josh](https://www.ruby-forum.com/u/josh)\ **Post date:** [January 24, 2006, 5:40pm UTC](https://www.ruby-forum.com/t/password-fields-and-security/96572/6 "2006-01-24T17:40:37Z")
On 1/24/06, Bob S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Questionable whether this should be a framework thing or controlled by the > programmer. I think I would rather have control over it then have it imposed > on me. Better yet, maybe a password field could recognize a :reset\_on\_error > attribute or something similar. For reference, the Struts tag html:password has an attribute called “redisplay” that defaults to true. Makes it easy for the developer to decide how he wants the field to behave, and seemed like a pretty simple solution. – James