HTML5 form submission lacks built-in deduplication for non-idempotent POST resubmission

Limits of native duplicate prevention

The HTML Living Standard defines form submission with method="POST" as non-idempotent but does not specify any browser-level mechanism to prevent duplicate server-side processing when a user manually resubmits—whether by refreshing a POST result page, navigating back/forward, or restoring a page from bfcache. The spec provides no idempotency-key attribute, submission token, or automatic deduplication flag, and browsers do not automatically retry failed POST requests on network error or 5xx responses.

Current workarounds are application-level

Developers must implement patterns such as Post-Redirect-Get (PRG), disabling the submit button via JavaScript after first click, or generating and validating server-side idempotency keys. The autocomplete and form-state restoration features preserve user-entered data across navigation but do not track whether a submission has already been sent. Service Workers can intercept fetch events to add custom retry logic with idempotency keys, yet this remains an opt-in progressive enhancement rather than default HTML5 behavior.

Open questions

• Are there any proposed spec additions (e.g., a dedupe attribute or standard idempotency-key header) that would give browsers a native signal to suppress duplicate POST submissions?
• Does the current bfcache restoration algorithm in major engines ever re-dispatch a submit event automatically, or is a user gesture always required?
• What is the recommended verification approach to confirm that a given browser version will not silently re-POST on back/forward navigation without a confirmation prompt?