-
Suggestion
-
Resolution: Won't Fix
-
None
-
None
There should be a configuration available through "Confluence Admin" that sets the "Remember me" checkbox on the login page to be checked by default.
Though I don't have any suggestions to offer regarding the current UI, I find that most users aren't really aware of the checkbox, nor do they investigate it. They just skip over it directly to "Log In". Most of these users instead choose to have their web browser remember the password - which is less secure, as it requires the web browser to remember the password, instead of just a cookie that stores the Confluence session ID - from which the password cannot be retrieved.
I'm including a patch for login.vm that can be used to change the checkbox to be checked by default. This is not an ideal work-around, as the patch will need to be re-applied with any upgrade to Confluence.
[CONFSERVER-22650] Login page should be configurable to check "Remember me" by default
Thanks for the suggestion, Mark.
We recently changed the login page to make it opt-in for 'Remember me'. This is a security feature of Confluence and designed to prevent people accidentally storing authentication cookies on public or shared computers.
Unless there's a lot more demand for this, we aren't planning to change our decision or add more security options to Confluence. Our current position is that enabling 'Remember me' by default makes it too easy for Confluence authentication cookies (which are valid for two weeks by default) to be inadvertently shared by users.
This option would be very interesting for our company because of the following (please reroute me to some other issue if exists):
When user gets email notification about change on some Confluence page, he clicks on the link. Confluence asks for login, so user logs in, everything OK here. But, when he clicks on some other page (or even on the same page), Confluence asks him once again to log in. It's like the given (first) authentication "works" only for that page (and click). This case is on IE9. On Firefox, it works OK. In Firefox, I can login once and navigate to other pages without problems. Workaround is to check "Remember me" option in IE, but it's unconvenient for most users to do that every time they log in. Since hundreds of users use IE9, it's much easier that we have default option "Remember me" checked.
Any ideas?