title: Where is the browser getting these HTML form fields?
body: <p>A website presents a login form containing simply "Username" and "Password". Pressing enter or clicking the "Login" button logs you in. </p>
  
  <p>The HTML form (from the page source) looks like this:</p>
  
  <pre><code>&lt;form name="login" action="https://www.mywebsite.com/index.php?main_page=login&amp;amp;action=process" method="post" id="loginForm"&gt;&lt;fieldset&gt;
  &lt;legend&gt;Please Log In&lt;/legend&gt;
  
  &lt;label class="inputLabel" for="email-address"&gt;Email Address:&lt;/label&gt;
  &lt;input type="text" name="email_address" size = "41" maxlength= "96" id="email-address" /&gt;&lt;br class="clearBoth" /&gt;
  
  &lt;label class="inputLabel" for="login-password"&gt;Password:&lt;/label&gt;
  &lt;input type="password" name="password" size = "41" maxlength = "40" id="login-password" /&gt;&lt;br class="clearBoth" /&gt;
  &lt;input type="hidden" name="securityToken" value="0330682553ea36639f62317144927f3f" /&gt;&lt;div class="buttonRow forward"&gt;&lt;input type="image" src="includes/templates/lite_grey/buttons/english/login.gif" alt="Sign In" title=" Sign In " /&gt;&lt;/div&gt;
  &lt;div class="buttonRow back important"&gt;&lt;a href="https://www.mywebsite.com/index.php?main_page=password_forgotten"&gt;Forgot password&lt;/a&gt; | &lt;a href="index.php?main_page=activation_email&amp;resend=1"&gt;Re-send activation email&lt;/a&gt;&lt;/div&gt;
  &lt;/fieldset&gt;
  &lt;/form&gt;
  </code></pre>
  
  <p>The form contains two visible fields (email_address and password), and one hidden field (securityToken).</p>
  
  <p>When I fill the form and press enter in my browser, the browser generates a POST request that looks like this:</p>
  
  <p>POSTDATA=email_address=my@emailaddress.org&amp;password=mypass123&amp;securityToken=0330682553ea36639f62317144927f3f&amp;x=37&amp;y=15</p>
  
  <p>(I was able to see this post-data by using the "Tamper data" plugin for Firefox. Also confirmed with wireshark)</p>
  
  <p>Notice the fields that the browser is sending: email_address, password, securityToken - and two other fields that didn't exist in the HTML code: x=37 and y=15. I am at a loss as to where these values come from.</p>
  
  <p>In addition, those values, x and y, change every time I login to the website. </p>
  
  <p>All browsers seem to be able to handle this login form just fine (not just Firefox). The HTML page doesn't seem to be obfuscated or anything..</p>
  
  <p>Any ideas where these values are coming from or how I can find out?                                                                                                                                                                            </p>
  
  <p>Thanks</p>