caolan/forms — Issue #13: Form state is shared between different requests
Author: powmedia
Created: 2011-10-12 16:14:38+00:00
State: open

Using: NodeJS 0.4.12, Express: 2.4.7

```javascript
//controller.js, imported into app.js

var forms = require('../lib/forms'),
fields = forms.fields,
validators = forms.validators;

var signupForm = forms.create({

first_name: fields.string({ required: true }),
last_name: fields.string({ required: true }),
email: fields.email({ required: true }),
password: fields.password({ required: true }),
password_confirm: fields.password({
required: true,
validators: validators.matchField('password')
})

});

module.exports = function(app) {

app.get('/signup', function(req, res, next) {
res.render('signup', {
signupForm: form.toHTML()
});
});

app.post('/signup', function(req, res, next) {
signupForm.handle(req.body, {
success: function(form) {
res.redirect('/app');
},
other: function(form) {
res.render('signup', {
form: form.toHTML()
});
}
});
});
};
```

I've been seeing some strange behaviour, here's the steps to reproduce:
1. Create form
2. Open one browser and fill in the form, so it fails validation.
3. Open a different browser, visit the '/signup' route and the form will be pre populated, showing data that the other browser (user) entered. Potentially displaying sensitive user info to another user.

Seems like the original signupForm object is being modified when bound to a request's form data?