A new <sensitive></sensitive> component to force all <form> components have a POST action by default

[nickcatal]

Goals

1. When a sensitive form is rendered for the user but they have javascript disabled, the lack of a preventDefault firing will result in data appearing in the URL query params
2. Going forward additional security protections can be applied to components inside a <sensitive></sensitive> area
3. Going forward, warnings can be issued if a password input field is not inside a <sensitive> area

Non-Goals

No response

Background

Currently if Javascript is disabled by a user's browser on first load (or if there is a delay of some sort in loading the bundle), if there is a <form> on the page which relies on preventDefault() to stop submission, the content of that form will be put a query params in the URL.

If one of these params is a password (or other sensitive data), the password will appear in access logs as well as in analytics tools such as Google Analytics, which will be impossible to scrub.

Proposal

Have a new component which searches for forms inside of it and rewrite them to be POST if the form is server-rendered (unless explicitly defined otherwise.)