If I remember correctly it was deliberate not to have autocomplete

With the uprising of password managers, I no longer see a valid reason for it not to have them.

I have tested this item ✅ successfully on 5c9f118

I have tested this item ✅ successfully on 5c9f118

@brianteeman Possibly this decision was made at a time when not all browsers supported autocomplete in the right way? Do you know or remember any details?

Assuming that all browser supported by J4 support autocomplete, I set this RTC.

https://developer.mozilla.org/en-US/docs/Web/Security/Securing_your_site/Turning_off_form_autocompletion#the_autocomplete_attribute_and_login_fields

Back to pending until discussed with SST. Thanks @brianteeman for the links.

But yet the login form uses autocomplete and password auto fill /fail

Can't have it both ways!

@brianteeman When following your link, I read:

For this reason, many modern browsers do not support autocomplete="off" for login fields
...
The browser still offers to remember this login.

All in all the article describes how to disable the autofill property and that this can be a bit tricky, and so not providing it doesn't necessarily mean it is disabled for all browsers, and so I think this PR doesn't do any harm but fixes it by providing the correct hint to the browser.

RTC again. Final decision takes the one who reviews again and merges.

If I remember correctly it was deliberate not to have autocomplete

I found the reason in the history and it was raised by many people - however it does not apply here

Thanks for checking and reporting back.