@htmx_only decorator about django-htmx

[bittner]

It doesn't offer any security or UX improvements.

Interesting. I would have said the opposite is an obvious conclusion. Agreed, w.r.t. application security, blocking unwanted calls doesn't close holes in a vulnerable application, but it makes the implementation cleaner when we allow intended use only. Also imagine URLs indexed by a search engine: People landing there are certainly not amused.

loading up a fragment URL can be useful, at least for debugging with webdev tools or django-debug-toolbar

@valberg suggested to allow loading a fragment when DEBUG=True in #205 (comment). I feel that might be a good idea.

[adamchainz]

The idea was already rejected in #205.

I don't really like blocking requests simply because they didn't set the magic htmx header. It doesn't offer any security or UX improvements. Plus loading up a fragment URL can be useful, at least for debugging with webdev tools or django-debug-toolbar.

[adamchainz]

You're always free to implement such a decorator in your projects. I remain unconvinced to add one to this package.