limited-diamond-93357
12/31/2021, 1:18 AMlimited-diamond-93357
12/31/2021, 1:19 AMlimited-pillow-24427
12/31/2021, 1:20 AM<li>
<input type="checkbox" id="checkbox-done-{{task.id}}" value="" checked="checked"
hx-post="{% url 'complete' task.id %}" hx-trigger="click">
<label for="checkbox-done-{{task.id}}"><del> {{ task.name }} </del> </label>
<a href="#" role="button" class="delete-button" hx-post="{% url 'delete' task.id %}">x </a>
limited-diamond-93357
12/31/2021, 1:20 AMlimited-diamond-93357
12/31/2021, 1:21 AMhx-post
, the addEventListener('htmx:configRequest',
means the request will include the CSRF token.limited-pillow-24427
12/31/2021, 1:24 AMlimited-pillow-24427
12/31/2021, 1:30 AMhx-post
with csrf token, when another hx-post
cant see that/didnt find token on the same page?limited-pillow-24427
12/31/2021, 1:33 AMuser
12/31/2021, 9:21 AMuser
12/31/2021, 9:22 AMprehistoric-cat-63987
12/31/2021, 10:07 AMuser
12/31/2021, 10:07 AMuser
12/31/2021, 10:08 AMprehistoric-cat-63987
12/31/2021, 10:09 AMuser
12/31/2021, 10:13 AMuser
12/31/2021, 10:24 AMuser
12/31/2021, 10:24 AMuser
12/31/2021, 10:24 AMuser
12/31/2021, 10:39 AMcool-camera-13454
12/31/2021, 10:58 AM<form>
POST requests (performed with regular HTTP requests).
In your example code, I believe your <form>
is submitting a regular HTTP request, even if you use the <hx-post>
attribute. I think that because your <button>
has type=submit
which inside a <form>
submits a regular POST request. You can check this by looking at the request headers, and seeing if the htmx headers (especially HX-Request:true
) are present. Since you are using Django's {% csrf_token %}
template tag inside the form, that would explain why your csrf_token is included in your request, which makes the Django middleware accept it and not reject it due to a possible CSRF attack.
For your other elements POSTing with hx-post
, I am not sure why the CSRF token is not included with them. You mention you are including the CSRF token with the JS event listener. This should suffice to have your htmx POST requests include the CSRF token. Django usually sets a cookie with a CSRF token, so that the token is available for subsequent POST requests. Maybe that cookie is not being set for your case? For this case I tried your code on my side and it seemed to work. I made some changes to simulate the completion and deletion of tasks, but the POSTing seems to work on my side. Maybe you can try my code and see if it works for youcool-camera-13454
12/31/2021, 11:00 AMcool-camera-13454
12/31/2021, 11:03 AMXCSRFToken
is not the same as the cookie with the CSRF token. It seems a new value is created each time for the first, whereas the latter remains unchanged as long as the cookie is valid...cool-camera-13454
12/31/2021, 11:11 AMlimited-pillow-24427
12/31/2021, 11:12 AMcool-camera-13454
12/31/2021, 11:17 AMuser
12/31/2021, 11:19 AMcool-camera-13454
12/31/2021, 11:25 AM