[stimulus-bundle] Set autocomplete=off attribute using JS on hidden C…

…SRF fields
symfony · Dec 29, 2024 · 64e95d1 · 64e95d1
1 parent 5f3e6c5
commit 64e95d1
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/symfony/stimulus-bundle/2.20/assets/controllers/csrf_protection_controller.js b/symfony/stimulus-bundle/2.20/assets/controllers/csrf_protection_controller.js
@@ -14,6 +14,7 @@ document.addEventListener('submit', function (event) {
 
     if (!csrfCookie && nameCheck.test(csrfToken)) {
         csrfField.setAttribute('data-csrf-protection-cookie-value', csrfCookie = csrfToken);
+        csrfField.setAttribute('autocomplete', 'off');
         csrfField.value = csrfToken = btoa(String.fromCharCode.apply(null, (window.crypto || window.msCrypto).getRandomValues(new Uint8Array(18))));
     }