Your goal is effectively to control browser behaviour and prevent it from storing the password which was entered and sent by the user anywhere (neither cache nor password-storage). As this is client-side software, you generally can't. But we can work out a solution which will achieve what you want in most cases. Please do note that you will never have full control over what the browser stores in RAM, but this is not really a problem. An attacker capable of compromising RAM is also capable of logging keystrokes.
Prevent a submit event from happening
Most browsers notice when you submit a form, because you click a special button (type="submit"
). This will probably promt the user "Do you want to store the password for this site?". To prevent this, you can implement this on your own. Don't set type="submit"
but create a button <button onclick="performLogin()"
that, if clicked, grabs the values of your input fields and wraps them in an HTTP-POST request to your site. If the login is successful, return the session key and write it to a cookie or whatever suits your requirements. Using this approach, you never trigger a real "submit event", but only a click event which won't promt the user for saving the password.
The cache question is trickier and I'm afraid, I don't see a consistent, reliable solution for this one as a browser won't let a random website dictate how it organizes its RAM. However, I can't see a huge drawback when ignoring it. As mentioned above, malicious code capable of reading arbitrary RAM are probably (not always) able to log keystrokes, compromising the password, which is what you are trying to avoid.
P.S.: Always be careful when implementing security measures or authentication mechanis on your own. As goteguru correctly said, "implementing your own security solution may have pitfalls". I'd increase this to "absolutely has pitfalls capable of screwing you over in various ways you never expected, if not handled properly".