While developing a website I noticed some unusual activity while testing it in Safari. Given a form such as: ``` <form> <input type="hidden" name="token" value="[SOME LONG RANDOM STRING HERE]" autocomplete="off"> <input type="password" name="password" autocomplete="new-password"> <input type="password" name="password_confirmation" autocomplete="new-password"> </form> ``` The browser is setting the token to the user's email address. The workaround involved using the `Referer` header when the `User-Agent` matches Safari but no other browser ran into this issue.
Likely a Safari issue, not a WebKit one. Importing the bug into radar so that it can be sent to the right people.
<rdar://problem/88753523>