Bug 236432 – Autofill sets the `value` of an `<input>` with `name="token"` to the user's email address

• Status: RESOLVED
• Resolution: MOVED
• Component: Forms

[Brody]

While developing a website I noticed some unusual activity while testing it in Safari.

Given a form such as:

```
<form>
  <input type="hidden" name="token" value="[SOME LONG RANDOM STRING HERE]" autocomplete="off">
  <input type="password" name="password" autocomplete="new-password">
  <input type="password" name="password_confirmation" autocomplete="new-password">
</form>
```

The browser is setting the token to the user's email address. The workaround involved using the `Referer` header when the `User-Agent` matches Safari but no other browser ran into this issue.

[Chris Dumez]

Likely a Safari issue, not a WebKit one. Importing the bug into radar so that it can be sent to the right people.

[Radar WebKit Bug Importer]

<rdar://problem/88753523>