Why does <.form> discard method and CSRF token when :action is absent, and is action="" a reliable way to submit to the current URL?

saveman71

Hello !

We want new/edit form pages to POST/PUT to their own URL rather than the resources REST defaults (post /things, put /things/:id), so that changeset error re-renders keep the browser URL stable: F5 reloads the form instead of GET-ing the index/show URL, and our URL matching JS bundle loading keeps working without hacks.

This has been a recurring source of issues on our end so we’re currently writing an internal guide/credo check to enforce that.

Regarding the form target, in plain HTML you’d get this for free by omitting action: the form then submits to the current URL.

But Phoenix.Component.form/1 explicitly discards method and the CSRF token in that case (docs).

Today we pass the page’s own URL explicitly:

<.form for={@form} action={~p"/things/#{@thing}/edit"} method="put">

That works, but means that a template shared between new and edit has to conditionally rebuild the URL the browser is already on, adding extra steps to check and maintain.

Two questions:

Is there a reason for discarding method/csrf_token when :action is absent for dead views?
action="" seems to work as a “submit to current URL”: HTML treats an empty action as the document’s URL, and it’s truthy so the component renders method and the CSRF token. Is that supported behavior we can rely on?

A side effect is that it’s going to call Plug.CSRFProtection.get_csrf_token_for(""), which returns a valid token but unscoped as far as I understand. Is this bad?

Thanks in advance for any insight.

5 comments

/phoenix

1 903 5

2026-07-15 23:40:37 UTC

Showing Posts 1 to 5

Show Best Posts
Show All (oldest first)
Show All (newest first)

nseaSeb

<.form for={@form} action="" method={if @thing, do: "put", else: "post"}>
It guess in this case “” is truthy in Elixir, so <.form> takes the “action provided” branch and normally generates the hidden _method field and the CSRF token.
Maybe send the URL by another approach ?

Post #1

LostKobrakai

Not just in this case. Only false and nil are falsy in elixir, everything else is truthy.

Post #2

GrammAcc

Regarding the last question about the unscoped token being bad or not, I think that would depend on your threat model and if you have multiple hostnames on the same application. Taking a look at the source plug/lib/plug/csrf_protection.ex at 9fa11c8ebedbe68531eba25d8f81b9282e0514da · elixir-plug/plug · GitHub calling Plug.CSRFProtection.get_csrf_token_for("") is the same as calling Plug.CSRFProtection.get_csrf_token/0 since URI.parse("") returns a %URI{} with all null values. So if your application’s threat model disallows get_csrf_token/0, then it would be bad. If get_csrf_token/0 isn’t an issue, then it’s not bad.

Post #3

saveman71

Thank you for your answer! We’ll have to determine if this is of a special concern to us or not.

I determined that we always hit [this clause](plug/lib/plug/csrf_protection.ex at 9fa11c8ebedbe68531eba25d8f81b9282e0514da · elixir-plug/plug · GitHub) anyway as of now as we never cared to provide full urls, so the initial question wasn’t really relevant, but we still need to determine if we should provide them from now on.

Post #4

GrammAcc

I think the most common scenario where this would be a concern would be if your application is using sub-domains. E.g. www.example.com and intranet.example.com You probably wouldn’t want a user to be able to make a fetch call from the console in their browser on the public site and get internal company pages. Ofc, in that scenario, you’d usually want to have your internal resources behind a company VPN or VLAN or something else that requires auth.

Another thing to keep in mind is that URI.parse/1 doesn’t return a host key unless the full URL with scheme is provided.

For example:

URI.parse("www.elixirforum.com") = %URI{path: "www.elixirforum.com", scheme: nil, port: nil, host: nil}
URI.parse("https://www.elixirforum.com") = %URI{path: nil, scheme: "https", port: 443, host: "www.elixirforum.com"}

Hope that helps. Cheers!

Post #5

— All posts loaded —