I suggest "bullet-proofing" any Rails-auto-added hidden fields by also auto-adding autocomplete="OFF"
As reported/diagnosed in May of WTFs: https://discuss.rubyonrails.org/t/form-with-first-field-value-is-overriden-with-a-token-like-string/74861/11 there is a 12-year-old Firefox bug that (sporadically, but pretty frequently) overwrites the first hidden_field in a form UNLESS it has autocomplete=OFF
The forum discussion doesn't propose any action other than nag Mozilla (who left it there for 12 years).
The results are to semi-randomly crash perfectly-coded Rails apps if, say, Rails inserts "_method=patch" but it gets submitted as "_method=5f4ledBRFGRYSUpaeJ29y-J0SX6KRSzbr1zSjVvgy1fhGmQAXXzsjLxdswyBtqopEnO6pQAaJTEFUJKXDVyisg" as in the specific example shown below (Firefox,on the left, Chrome on the right).
Because the addition of autocomplete=OFF does fortunately seem to workaround 100%, it seems to me to be a simple, safe, benign, no-side-effects addition. I'd submit a PR if I had any idea how.
I suggest "bullet-proofing" any Rails-auto-added hidden fields by also auto-adding autocomplete="OFF"
As reported/diagnosed in May of WTFs: https://discuss.rubyonrails.org/t/form-with-first-field-value-is-overriden-with-a-token-like-string/74861/11 there is a 12-year-old Firefox bug that (sporadically, but pretty frequently) overwrites the first hidden_field in a form UNLESS it has autocomplete=OFF
The forum discussion doesn't propose any action other than nag Mozilla (who left it there for 12 years).
The results are to semi-randomly crash perfectly-coded Rails apps if, say, Rails inserts "_method=patch" but it gets submitted as "_method=5f4ledBRFGRYSUpaeJ29y-J0SX6KRSzbr1zSjVvgy1fhGmQAXXzsjLxdswyBtqopEnO6pQAaJTEFUJKXDVyisg" as in the specific example shown below (Firefox,on the left, Chrome on the right).
Because the addition of autocomplete=OFF does fortunately seem to workaround 100%, it seems to me to be a simple, safe, benign, no-side-effects addition. I'd submit a PR if I had any idea how.