Hello !

We want new/edit form pages to POST/PUT to their own URL rather than the resources REST defaults (post /things, put /things/:id), so that changeset error re-renders keep the browser URL stable: F5 reloads the form instead of GET-ing the index/show URL, and our URL matching JS bundle loading keeps working without hacks.

This has been a recurring source of issues on our end so we’re currently writing an internal guide/credo check to enforce that.

Regarding the form target, in plain HTML you’d get this for free by omitting action: the form then submits to the current URL.

But Phoenix.Component.form/1 explicitly discards method and the CSRF token in that case (docs).

Today we pass the page’s own URL explicitly:

<.form for={@form} action={~p"/things/#{@thing}/edit"} method="put">

That works, but means that a template shared between new and edit has to conditionally rebuild the URL the browser is already on, adding extra steps to check and maintain.

Two questions:

1. Is there a reason for discarding method/csrf_token when :action is absent for dead views?
2. action="" seems to work as a “submit to current URL”: HTML treats an empty action as the document’s URL, and it’s truthy so the component renders method and the CSRF token. Is that supported behavior we can rely on?

A side effect is that it’s going to call Plug.CSRFProtection.get_csrf_token_for(""), which returns a valid token but unscoped as far as I understand. Is this bad?

Thanks in advance for any insight.