Unvalid HTML generated for CSRF input

[jimblue]

Bug description

Hi there,

As explained in the Statamic doc here:

When using form:create tag, Statamic will automatically take care of opening your form with a proper CSRF token .

Unfortunately the generated HTML seems to not be valid:

<input type="hidden" name="_token" value="cN03woeRj5Q0GtlOj7GydsZcRwlyp9VLzfpwDFJZ" autocomplete="off">

As autocomplete="off" should not be used on <input type="hidden">.

How to reproduce

Just create a form with the form:create tag.

Logs

No response

Environment

Environment
Application Name: Jean-Marie Belloteau
Laravel Version: 10.48.3
PHP Version: 8.3.4
Composer Version: 2.7.2
Environment: local
Debug Mode: ENABLED
URL: immersion-pictures.test
Maintenance Mode: OFF

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: NOT CACHED

Drivers
Broadcasting: null
Cache: redis
Database: mysql
Logs: stack / single
Mail: smtp
Queue: redis
Session: file

Statamic
Addons: 1
Antlers: runtime
Sites: 1
Stache Watcher: Enabled
Static Caching: Disabled
Version: 4.53.2 PRO

Statamic Addons
statamic/seo-pro: 5.4.1

Installation

Fresh statamic/statamic site via CLI

Antlers Parser

Runtime (default)

Additional details

No response

[jasonvarga]

As autocomplete="off" should not be used on .

Do you have a source for this?

[jasonvarga]

This comes directly from Laravel anyway. They intentionally add autocomplete="off". You can read about it here: laravel/framework#48371

[jimblue]

Hi Jason,
Ok thank you for point me to the related Laravel issue. 🙏🏼