3 ms·
For the sake of being precise - the “form_with” is not equivalent to the presented HTML. The form_with helper injects an additional hidden input element that ma
by stanislavb 3y ago
For the sake of being precise - the “form_with” is not equivalent to the presented HTML. The form_with helper injects an additional hidden input element that makes sure that the form cannot be submitted “illegally”.
- codeptualize 3y agoI think this is a great example of all the small details we take for granted in the tools we use, and we would miss without realising when following these tips.
- tonyennis 3y agoThat hidden CSRF field can be added without form_with though, and Rails still protects against not including it. I left it out of the example as it didn't seem relevant
- stanislavb 3y agoYes, it can be added, but manually going over all form. Also, how would it protect against a CSRF without the token in place? Note: I totally agree that we should strive to go HTML first. However, this specific example is a bit unfair.