sveltejs / sveltejs/kit

remote function underscore does nothing

Open
#15,051 2 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation
Dominant language
JavaScript
Stars
20.8k
Forks
2.3k
Avg merge
1d 16h
Merged PRs (30d)
156

Description

Describe the bug

The docs say that adding an underscore prevents the value from being sent back to the user. This does not happen, values with underscores are still repopulated in the input.

Reproduction

+page.svelte:
`<script>
import { register } from '$lib/register.remote';
</script>

Username
<label>
	Password
	<input {...register.fields._password.as('password')} />
</label>

<button>Sign up!</button>
`

register.remote.ts:
`import * as v from 'valibot'
import {form} from '$app/server'
import { invalid } from '@sveltejs/kit'

export const register = form(v.object({
username: v.string(),
_password: v.string()
}), async ({username, _password }) => {
invalid('invalid credentials')
})`

Logs

System Info
System:
    OS: macOS 15.4.1
    CPU: (8) x64 Intel(R) Core(TM) i5-1038NG7 CPU @ 2.00GHz
    Memory: 1.20 GB / 16.00 GB
    Shell: 5.9 - /bin/zsh
  Binaries:
    Node: 25.2.1 - /usr/local/bin/node
    npm: 11.6.2 - /usr/local/bin/npm
    pnpm: 10.8.0 - /usr/local/bin/pnpm
    bun: 1.2.8 - /Users/matteopiatti/.bun/bin/bun
  Browsers:
    Chrome: 142.0.7444.177
    Firefox: 142.0.1
    Safari: 18.4
  npmPackages:
    @sveltejs/adapter-auto: ^7.0.0 => 7.0.0 
    @sveltejs/kit: ^2.49.2 => 2.49.2 
    @sveltejs/vite-plugin-svelte: ^6.2.1 => 6.2.1 
    svelte: ^5.43.8 => 5.45.8 
    vite: ^7.2.2 => 7.2.7
Severity

annoyance

Additional Information

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the provided +page.svelte and register.remote.ts reproduction, then trace SvelteKit's remote-function form handling to see where underscore-prefixed fields are serialized or repopulated. Add a regression test for the _password field and verify that submitting an invalid form does not send its value back to the user.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
web-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.