Skip to content
Sarj Code Standards

no-password-get-form

Keep named password controls out of native GET form submissions.

passwordGet Rule source Tests Catalog JSON

Why

Native GET submission serializes enabled, named password controls into the URL, exposing credentials through browser history and request logs. GET is also the default for missing or invalid method attributes.

Fix

Review the destination endpoint and submit credentials with POST. Keep server-side validation, HTTPS and the appropriate anti-CSRF protections; this rule only checks the native form serialization boundary.

Examples

Before — flagged Review password serialization into the URL
src/view.tsx
<form>
  <input type="password" name="password" />
</form>;
After — preferred Submit the password with POST
src/view.tsx
<form method="post">
  <input type="password" name="password" />
</form>;

References