236432 2022-02-10 00:29:47 -0800 Autofill sets the `value` of an `<input>` with `name="token"` to the user's email address 2022-02-10 07:26:53 -0800 1 1 1 Unclassified WebKit Forms Safari 15 Unspecified macOS 12 RESOLVED MOVED InRadar P2 Normal --- 1 brody webkit-unassigned cdumez webkit-bug-importer wenson_hsieh oldest_to_newest 1839554 0 brody 2022-02-10 00:29:47 -0800 While developing a website I noticed some unusual activity while testing it in Safari. Given a form such as: ``` <form> <input type="hidden" name="token" value="[SOME LONG RANDOM STRING HERE]" autocomplete="off"> <input type="password" name="password" autocomplete="new-password"> <input type="password" name="password_confirmation" autocomplete="new-password"> </form> ``` The browser is setting the token to the user's email address. The workaround involved using the `Referer` header when the `User-Agent` matches Safari but no other browser ran into this issue. 1839639 1 cdumez 2022-02-10 07:25:13 -0800 Likely a Safari issue, not a WebKit one. Importing the bug into radar so that it can be sent to the right people. 1839640 2 webkit-bug-importer 2022-02-10 07:25:24 -0800 <rdar://problem/88753523>