form_build_id is a hidden input field and therefore should not have the autocomplete attribute

Created on 10 November 2022, over 2 years ago
Updated 22 August 2023, almost 2 years ago

Problem/Motivation

FormBuilder::prepareForm adds a form_build_id element, which is a hidden input, eg:

<input autocomplete="off" data-drupal-selector="form-v8temxqitapn2hablkw4gfmqyls0f5pmiy9tcd3p5gy" type="hidden" name="form_build_id" value="form-V8tEmXQITAPn2hAblkW4gfMQYls0F5pmiy9tCd3P5GY" />

This is invalid HTML, as confirmed by the W3 HTML Validator:
An input element with a type attribute whose value is hidden must not have an autocomplete attribute whose value is on or off.

This error gets flagged by automated accessibility testing software, such as SortSite.
Bad value for attribute autocomplete.
<input autocomplete="off" data-drupal-selector="form-v8temxqitapn2hablkw4gfmqyls0f5pmiy9tcd3p5gy" type="hidden" name="form_build_id" value="form-V8tEmXQITAPn2hAblkW4gfMQYls0F5pmiy9tCd3P5GY" />

Looking back at the git history, autocomplete=off was added back in 2018 by https://www.drupal.org/project/drupal/issues/2596597 โ†’ to fix a bug with Firefox browsers.

I have tested removing autocomplete=off and tried to reproduce the bug described in the original ticket and have been unable to reproduce the error with this fix removed. This leads me to think that either the Firefox browser has fixed the underlying issue since then, or something else within core has changed which solves it a different way. Either way, I think it's safe to remove.

Steps to reproduce

* Log in and go to a node add form
* View source and look for the hidden input element with name="form_build_id"
It currently has autocomplete=off but this should be removed.

Proposed resolution

Remove autocomplete=off from FormBuilder::prepareForm

๐Ÿ› Bug report
Status

Needs work

Version

9.5

Component
Formย  โ†’

Last updated 1 day ago

Created by

๐Ÿ‡ฌ๐Ÿ‡งUnited Kingdom nicrodgers Monmouthshire, UK

Live updates comments and jobs are added and updated live.
  • Needs tests

    The change is currently missing an automated test that fails when run with the original code, and succeeds when the bug has been fixed.

Sign in to follow issues

Merge Requests

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024