title: A data breach on a site exposed your password message sent by chrome on my login form
body: <p>I made a login form, an authenticated user is redirected to their home page. But, along with redirection chrome sent me this <a href="https://i.stack.imgur.com/4hO3d.png" rel="noreferrer"><img src="https://i.stack.imgur.com/4hO3d.png" alt="This is the message sent by chrome"></a></p>
  
  <p>I know nothing about the warning. My code is:</p>
  
  <pre><code>     /**
       * Go Login, login button is clicked
       * 
       * @return void
       */
      public function goLoginAction()
      {
          $user = new User($_POST);
  
          if ($user-&gt;verifyPassword()) {
              $user = User::findByUsername($user-&gt;username);
  
              Auth::login($user);
  
              $this-&gt;redirect("/$user-&gt;username/home/");
          } 
  
          $this-&gt;redirect('/');
  
      }
  </code></pre>
  
  <p>go-login is the action of the form. So, $_POST is sent to go-login. 
  verifyPassword is the function to verify password:</p>
  
  <pre><code>     /**
       * Verify password
       * 
       * @return true if password is correct, false otherwise
       */
      public function verifyPassword()
      {
          $users = static::findByUsername($this-&gt;username);
          if (password_verify($this-&gt;password, $users-&gt;password)) {
              return true;            
          }
          return false;
      }
  </code></pre>
  
  <p>findByUsername is the function to return the object user by username. And, Auth class in the go-login function creates the session:</p>
  
  <pre><code>     /**
       * Login controller
       * Set session after login
       * 
       * @param object $user 
       * @return void
       */
      public static function login($user)
      {
          session_regenerate_id();
  
          $_SESSION['id'] = $user-&gt;id;
      }
  </code></pre>
  
  <p>Every answer would be appreciated. And please let me know the other security tips as well. Thank you!!</p>