Question: how to deal with CSRF token expiry/invalidation? about django-htmx

[SHxKM]

Of course the solution is to extract a partial and inside the CSRF failed view, return the partial (not the whole layout) if request.htmx.

[adamchainz]

You could also use OOB to inject a banner or whatever

Would you like to add a section to the tips docs?

[SHxKM]

I’d be glad to give a little back.

under which section this would go though? CSRF invalidation seems a bit too specific..my solution above is already covered by your “partials” examples. Are you talking specifically about OOB updates?

[adamchainz]

I'd suggest a new section called “CSRF invalidation” in the “tips” section. We could try to cover a custom CSRF failure view with a request.htmx branch, and options for implementation, such as:

1. send a client redirect response to login page
2. trigger a client event
3. send an OOB banner to tell the user the problem with a link to reload.

What do you think?

[SHxKM]

I'd suggest a new section called “CSRF invalidation” in the “tips” section. We could try to cover a custom CSRF failure view with a request.htmx branch, and options for implementation, such as:

1. send a client redirect response to login page
2. trigger a client event
3. send an OOB banner to tell the user the problem with a link to reload.

What do you think?

That's a good idea. I'll do my best to get to this by the weekend.

[SHxKM]

I'd suggest a new section called “CSRF invalidation” in the “tips” section. We could try to cover a custom CSRF failure view with a request.htmx branch, and options for implementation, such as:

1. send a client redirect response to login page
2. trigger a client event
3. send an OOB banner to tell the user the problem with a link to reload.

What do you think?

That's a good idea. I'll do my best to get to this by the weekend.

Won’t have time for this in the next two weeks unfortunately. But it’s on my TODO right after that.