_csrf_token in simple_form: live_render yes, live route no

i-n-g-m-a-r · August 18, 2023, 8:43am

Using the same template containing:

<.simple_form :let={f} phx-change="handle_stuff">

When implemented using:

scope "/", MyappWeb do
  live "/stuff/:x/:y", StuffLive
end

Generates a form without:

<input name="_csrf_token" type="hidden" ...

While implementing the same template containing the same form using:

live_render @conn, MyappWeb.StuffLive

does generate a csrf-input inside the form:

<input name="_csrf_token" type="hidden" ...

Why does the live route behave differently?

i-n-g-m-a-r · August 18, 2023, 9:12am

Because StuffController assigns @action while StuffLive does not.

github.com

phoenixframework/phoenix_live_view/blob/fb111738d56745f37338867b9faea86eb9baa6e1/lib/phoenix_component.ex#L2146


      
          )
          
          attr.(:rest, :global,
            include: ~w(autocomplete name rel enctype novalidate target),
            doc: "Additional HTML attributes to add to the form tag."
          )
          
          slot.(:inner_block, required: true, doc: "The content rendered inside of the form tag.")
          
          def form(assigns) do
            action = assigns[:action]
          
            # We require for={...} to be given but we automatically handle nils for convenience
            form_for =
              case assigns[:for] do
                nil -> %{}
                other -> other
              end
          
            form_options =
              assigns