Turn off autocomplete for csrf_field generates HTML validation error

[Graphicfort]

An “input” element with a “type” attribute whose value is “hidden” must not have an “autocomplete” attribute whose value is “on” or “off”

To avoid HTML5 validation error, you can change:

return new HtmlString('<input type="hidden" name="_token" value="'.csrf_token().'" autocomplete="off">');

to

return new HtmlString('<input type="text" name="_token" value="'.csrf_token().'" autocomplete="off" style="display:none !important;">');

[valorin]

Inline styles could cause issues with Content Security Policies, so it would be better to just remove the attribute entirely.
It was added as a fix for a potential browser issue that turned out to be a different issue.

[Graphicfort]

I'm aware of safari issue. The problem I have a table with 50+ form so I'm getting 50+ validation errors, I ended up creating my own csrf field with a class to hide it, but this is not the best solution.

[valorin]

The Safari issue seemed to be that the page was being cached, so an older CSRF token was being submitted: #48371 (comment)

Inline styles are not a good solution. If it's causing issues, the attribute should be removed.