HTML5 : Hidden HTML field

The application uses a hidden field.

<input> elements of type hidden let web developers include data that cannot be seen or modified by users when a form is submitted.

The developer could assume that users would not see the hidden field and would not be able to manipulate the data transferred through it. It is not so: attackers can transfer data, including malicious data, to hidden fields.

A hidden field must not be used to transfer valuable information. Its contents are cached by the browser, which can lead to data confidentiality loss.