Skip to content

Conversation

@lcnicolau
Copy link
Contributor

Closes #36

Support secure CSRF protection for htmx-driven requests across all relevant HTTP methods.

Changes:

  • Minor updates to existing HtmxAttributeProcessor to make it easier to extend.
  • Created HtmxCsrfAttributeProcessor (with @since 5.1.0 annotation) to handle CSRF token injection.
  • Updated HtmxDialect to associate the new processor with post, put, patch, and delete attributes.
  • Added unit tests and updated README.md.

Implementation Notes:

  • Commit 1: Uses hx-vals to send the CSRF token. However, DELETE requests expose the token in query parameters.
  • Commit 2: Switches to hx-headers, which is more secure and aligns with htmx recommendation.
  • Both commits are kept for reference, but can be squashed if preferred.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support automatically adding CSRF token when using the custom processors

1 participant