Safari autofills hidden "reset password token" input

Question

Safari is actually overwriting a HIDDEN form field that is supposed to represent a password reset token (ID is user_reset_password_token and name is user[reset_password_token]) with my email address.

As you can imagine, resetting the password doesn't work when the token is incorrect, so I've got an issue.

I've confirmed that it works just fine if I disable autofill in Safari, or use any browser other than Safari.

Does anyone have a solution to this issue?

Answer 1

Just had the same issue. I solved the problem with adding readonly attribute to my hidden input, like this:

= f.hidden_field :reset_password_token, readonly: true

so I've got this:

<input id="user_reset_password_token" name="user[reset_password_token]" readonly="readonly" type="hidden" value="YXHRuRgppyzxqsdEXiNm">