Project final - Secure page
Combine all security techniques and document the page.
Final step: the sign-in form
You've reached the final step. The page has the bank name, instruction, external help link, CSP and referrer policy. Now you'll add the sign-in form.
The form has two fields: user code and password. Each field is a label + input pair; the label's for attribute matches the input's id. Below, a button type="submit" for submission.
Security and accessibility in the form
When adding the form, security and accessibility go together:
method="post": keep the password out of the URLtype="password": mask the password fieldautocomplete="current-password": browser fills only in the right contextrequired: block empty submissionslabel+for/id: screen readers match label to field
In this project all security layers come together.
Exercise Add the sign-in form
Take the previous lesson's page. In <body>, after the help link, add a sign-in form:
<form action="/signin" method="post">- Two
label + inputpairs:for/id="user"(type=text, autocomplete=username, required) andfor/id="password"(type=password, autocomplete=current-password, required) <button type="submit">Sign in</button>
Show example solution
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'">
<meta name="referrer" content="strict-origin-when-cross-origin">
<title>Secure Bank - Sign in</title>
</head>
<body>
<h1>Secure Bank</h1>
<p>Please sign in with your user code.</p>
<p><a href="https://help.securebank.example/signing-in" target="_blank" rel="noopener noreferrer">Help center</a></p>
<form action="/signin" method="post">
<p>
<label for="user">User code</label>
<input id="user" name="user" type="text" autocomplete="username" required>
</p>
<p>
<label for="password">Password</label>
<input id="password" name="password" type="password" autocomplete="current-password" required>
</p>
<button type="submit">Sign in</button>
</form>
</body>
</html>The Secure Bank page is complete!
Congratulations! You finished the Secure Bank sign-in page. It now contains:
rel="noopener noreferrer"on the external help link- CSP via
meta http-equiv="Content-Security-Policy" - Referrer policy via
meta name="referrer" - Accessible form with
method="post",type="password"andfor/idmatching
These four layers make even a small page as secure as a real bank page. You can reuse the same pattern on your own sites.
Test yourself
-
How do you link a <label> to an <input>?
<label ...>...</label> <input ...>- label for="x" and input id="x"
- label class="x" and input class="x"
- label name="x" and input id="x"
- label value="x" and input name="x"
Show answer
label for="x" and input id="x" — Correct. The for/id match links the label to the field; screen readers use it.
-
Complete the method value for password submission
<form action="/signin" method="____"> <label for="user">User code</label> <input id="user" name="user" type="text"> </form>Show answer
<form action="/signin" method="post"> <label for="user">User code</label> <input id="user" name="user" type="text"> </form> -
Match each form part to its role
- label for
- links label to field
- input type=password
- masks the password
- button type=submit
- submits the form
- autocomplete
- browser fill context