Rephrase security section for hidden inputs

[blunket]

Description

Clarify the security section on the docs about the hidden input type.

Motivation

I found the phrasing "pretty much any reputable server-side framework" to be opinionated in a negative way, so I replaced that phrasing first. Then I reorganized and clarified both paragraphs in that section and attempted to make it sound more neutral and professional in general.

[github-actions]

Preview URLs (1 page)

• /en-US/docs/Web/HTML/Reference/Elements/input/hidden

(comment last updated: 2026-06-25 14:22:12)

[wbamberg]

We now have a whole page on CSRF, including a section on CSRF tokens: https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/CSRF#csrf_tokens.

In my opinion it's better just to point to that page, than to try to summarise how CSRF and CSRF tokens work - I don't really think it's possible to summarise this in a way that's comprehensible and correct, so to understand it you have to read the full version anyway. So would be better, here, to say something like: "a common use of hidden fields is as CSRF tokens, which help protect websites against CSRF attacks".

[wbamberg]

I'm not sure how a CSRF token proves that the user is "who they say they are". AIUI it helps ensure that the page containing the form was really served by the legitimate server, and isn't on a malicious site.

This is also not quite right:

This would stop malicious users or bots from submitting a fake version of the form.

In CSRF, malicious users don't submit fake forms. The real user submits the fake form - that's why it's a problem (because it contains the real user's cookies).

Like I say, it's hard to explain this correctly, concisely, and comprehensibly, so I think it is better just to link to the guide page, where we have the space to explain it properly.

[blunket]

Completely agree with you. I was not confident enough in my own understanding to change that phrasing about proving identity.

In pointing to this page then, the whole section becomes two short sentences. Does it still need its own section at that point? I'll go ahead and try to update the PR if so. Otherwise we can move these details about security on the page if you agree with me.

Thank you for the feedback!

[wbamberg]

Yeah, it's a good question. I think it is probably worth keeping the section on this page even when it is very short, just to have it clearly signposted. And otherwise we get structural problems here, because Tracking edited content wants to be its own section, so then where do you put the security use case?

But sometimes this is the kind of thing you have to see, to get a feeling about whether it is sensible or not.

BTW I didn't say this before but I should have, or it sounds like I'm only complaining: I agree with your original motivation for making this change, and think this is an improvement. So, thank you!