This is my delete button that I use:

 @doc """
  This must not be inside of another form!
  """
  def delete_button(path), do: delete_button(path, :raised, [])
  def delete_button(path, btn_type) when is_atom(btn_type), do: delete_button(path, btn_type, [])
  def delete_button(path, opts) when is_list(opts), do: delete_button(path, :raised, opts)
  def delete_button(path, btn_type, opts) do
    {form, opts} = Keyword.pop(opts, :form, [])
    {form_class, form} = Keyword.pop(form, :class, "")
    form = Enum.map(form, fn {k, v} -> ~E{ <%= dasherize(k) %>="<%= v %>"} end)
    opts = opts ++ [do: "Delete"]
    opts = Keyword.put(opts, :class, "btn--red #{opts[:class]}")
    ~E"""
    <form action="<%= path %>" class="link <%= form_class %>" method="post"<%= form %>>
      <input name="_method" type="hidden" value="delete">
      <input name="_csrf_token" type="hidden" value="<%= get_csrf_token() %>">
      <%= button(:submit, btn_type, opts) %>
    </form>
    """
  end

And if I want an ‘are you sure’ kind of thing then I instead just put it inside a pure CSS collapsible element that I use here with the title of it as something like ‘Dangerous options’ or whatever and the delete button inside of it, so it first has to be expanded then the delete button can be clicked or so.

What if you are submitting the form via a link, though? For example, a link that triggers a delete request? I think then you would still need the JS.

Just for clarity, this is the important bit of it. It is a form with the action being the path to delete to, the method is ‘post’ (just because browsers don’t support non get/post methods very well), but then you override the method with the hidden input named _method with it’s value set to delete, and of course a CSRF token as all good forms should have, and the button to actually submit the delete form request.