Okay, I understand. Thanks a lot. And yes, as you say, that seems doable to implement a middleware (in whatever server tech you use), that would check the

HX-Request

header, and if it exists, only extract and return the

body

(or content, as you say) in the response.

I published my naming pattern here: https://github.com/guettli/django-htmx-fun

Thanks a lot for sharing that. Glad that people have different ways of doing it 👀 . I am having a look

Good morning. I'm sure there is a way to listen to SSE events via

<div hx-sse=...

and at the same time show new messages only for a short amount of time - I just haven't found it I guess 🙂

sounds like a job for hyperscript or alpine to me 🙂

yeah, worked like a charm

thx!

\> hyperscript \> worked like a charm, first time @User

Hey there 👋🏼

hey all - I've just started using HTMX for the first time today, and I'm working off this example code:

document.body.addEventListener('htmx:configRequest', function(evt) {
    evt.detail.parameters['auth_token'] = getAuthToken(); // add a new parameter into the mix
});

I want to do exactly the same thing, but my

getAuthToken

returns a promise (issues an HTTP request), is there a way to block until it's done? I.e. I want every request issued by my application to wait on the response of another request that solicits the auth token.

unfortunately, htmx events aren't designed to deal with async behavior like that. Let me think...

There's no way to encode the auth token directly in the DOM at render time?

I'm trying to use Shopify's App Bridge (https://shopify.dev/apps/auth/session-tokens/how-session-tokens-work), the token only lasts a minute. They provide a

fetch

based utility that they'd like people to use, but it's feeling a bit tricky to align with HTMX. Ideally I guess I'd like to add an interceptor and delegate everything to that utility, I suppose?

OK, this is going to be a tough one

let me think some more

can you give me a bit more context on what you are doing w/ shopify?

sure - as I understand it the latest scheme with Shopify apps is this session authentication. There's a reasonable diagram of it here: The central idea is that your backend uses OAuth to get a permanent token, and that token is used for backend -> Shopify communications. When it comes to authenticating users with your app you can leverage the authentication Shopify does for their own users for your app's authentication. When a Shopify store owner logs into their admin account and they click through to an application, instead of having to sign in to that application it uses Shopify's authentication. Their scheme is that you use this helper library (linked above) to constantly reauthenticate. On the user's behalf, the app sends a request and gets a JWT signed by Shopify with the app's secret. The backend can then validate the request is legit.

so I'm trying to do exactly that - create an app that has a frontend embedded within Shopify's admin portal. They're moving from a legacy strategy of cookies to this continuous reauthentication dance, where every request to the app's backend goes first to Shopify (to renew authentication), then to the backend

my goodness, how complicated can they make it

is there a way to establish just a single session token and use that for auth? getting a new token for every request is bananas (I admit, I'm old school)

contantly re-authenticating... how is this any better than just using whatever the credentials you ask for the "good for 1 minute" token?

OKOK

yeah, I'm not really seeing the motivation for this strategy. It's definitely what they've expressed is their path forward

it took the better part of a day to figure out how to even do it once - they're actively suggesting using a SPA because it's not obvious what the process actually is when it comes down to the real interactions

I guess it's not reauthenticating technically? The user is authenticated and I suppose it's in that grey area of the base authorization that appears as soon as you're an authenticated user?

here's their rationale for moving away from cookies: https://shopify.dev/apps/auth/session-tokens/how-session-tokens-work#third-party-cookies-vs-session-tokens

> As of April 2021, new submissions for embedded apps are required to use session tokens.

I've been wanting to use HTMX for a project, and was hoping this would provide a good excuse - I didn't appreciate how complicated the Shopify integration is if you do it "properly"

Yeah, this seems extremely SPA oriented, unfortunately.