Include a nonvisible value in form data.
HTML: A named hidden input contributes data without adding a visible editing control.
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Example</title>
</head>
<body>
<form><input type="hidden" name="record" value="42"><button>Save</button></form>
</body>
</html>Expected output EXAMPLE
The record input is invisible. FormData still contains record="42"; a hidden input is not a way to keep a value secret.
Details
Save as example.html and open in a modern browser. The output describes browser behavior verified with DOM and interaction assertions. A named hidden input contributes data without adding a visible editing control.
Hidden values are editable by clients and must never be trusted as authorization.
Tested on Ubuntu 24.04.5 LTS · · Chromium 141.0.7390.37 · libc6 2.39-0ubuntu8.9; Playwright 1.56.0
Test inputs, results and environment
The exact published code ran in a dedicated Linux test container with prepared inputs. Unprivileged snippet process, external networking disabled, read-only root filesystem, and a fresh temporary working directory. Fixtures and output records are isolated from the application database. Testing covers this example and its stated checks, not every input, operating system, or runtime version. The Linux container shares its host's kernel; this is not a native Windows test.
- Architecture / host kernel
- x86_64 / 6.18.54.1-microsoft-standard-WSL2
- Snippet identity / locale
- uid=65534, gid=65534 (unprivileged) / C.UTF-8
- Interpreter invocation
Chromium: open example.html; execute the published browser assertions- Container image ID
sha256:32dc2d998158b6554c99b73b533f423696a0f3e31e8cbea9db10b5eee9a2fadd- Code SHA-256
93c7a53eaf3642832bc39e26a96727711b0a5abf0bc26942ea5c9bc58bb2dc27- Dependencies
- libc6 2.39-0ubuntu8.9; Playwright 1.56.0
Test input setup
These are the prepared inputs used by the test harness. See Details above for the prerequisites and how to run this example.
# No input files required.
Observed standard output
Expected output describes the rendered page. The standard-output record below is the browser test harness receipt; the additional assertions check the result and interactions.
Include a nonvisible value in form data: browser checks passed.
Exit code: 0. Standard error: empty. Validation: Shape/content assertions. System-dependent values above are one recorded run.
Additional assertions that passed
Checks recorded by the test harness. Where Python assertions are shown, browser cases use Playwright and simulator cases may inspect pin transitions: result.stdout is captured output, work is the temporary directory, and Path is pathlib.Path. The harness also imports json and csv.
assert not await page.locator('input').is_visible()
assert await page.locator('form').evaluate('(e)=>new FormData(e).get("record")')=='42'