Open Radar

 
Summary:
Consider a website example.com, where your profile page is at example.com/user, and where visiting example.com/user/logout will log you out and redirect you to the home page.

When attempting to visit your profile page by typing the URL, Safari may suggest the logout URL as the Top Hit. If the "Preload Top Hit in the background" preference is turned on, you will be logged out, despite having committed to no input whatsoever.

This may result in anything from a minor inconvenience to major data loss, depending on the website.

The /user and /user/logout paths in the above example are used by the very popular CMS Drupal, which falls prey to this behavior.

Steps to Reproduce:
0. Have "Preload Top Hit in the background" turned on.

1. Visit an often-used website where the URL of a normal page is a prefix to the URL of another page that performs some destructive action.

2. Type the URL of the useful page, ignoring or deleting Safari's Top Hit autocompletion of the destructive page's URL, then push Return to visit it.

Expected Results:
You visit the useful page with no ill effects.

Actual Results:
Safari has logged you out of the site by preloading its suggested Top Hit, possibly losing data.

Version:
Safari 9.0.2 (11601.3.9)
OS X 10.11.2

Notes:
This problem is exacerbated by the fact that the destructive link may perform a redirect, thereby not being included in Safari's history, giving you no way of deleting it from possible Top Hit suggestions. See http://openradar.appspot.com/radar?id=5042427870052352

Configuration:
MacBookAir6,2
1.7 GHz Core i7
8 GB RAM