Add form_tag name attribute?
yawaramin opened this issue · 6 comments
Dream.form_tag
is great for creating secure forms but can we add a ~name:"some-name"
parameter? it's pretty traditional for forms to have the name
attribute set so they can be accessed from JavaScript like document.forms['some-name']
.
I guess to ask it another way, is there a way to customize the output of form_tag
with any attributes we need to put in there?
There isn't a way right now, but there should be. Would you be willing to open a PR to add either ?name
or ?attributes
to Dream.form_tag
? I would be happy to merge it :)
Sure, I'd be happy to, looks pretty simple. If you don't mind, could I just add name
, as attributes
would be a bit more tricky i.e. we'd need to ensure it didn't clash with the other arguments.
Actually, thinking about this a bit more–what do you think of using a Django-style csrf_token
value: https://docs.djangoproject.com/en/4.0/ref/csrf/
So instead of using form_tag
to render the beginning of the form, we could just write normal <form...>
tag and inject the token like:
let render req =
<form name="some-name" method="post" action="/"><%s! Dream.csrf_token req %>
...
</form>
Actually, thinking about this a bit more–what do you think of using a Django-style
csrf_token
value: https://docs.djangoproject.com/en/4.0/ref/csrf/So instead of using
form_tag
to render the beginning of the form, we could just write normal<form...>
tag and inject the token like:let render req = <form name="some-name" method="post" action="/"><%s! Dream.csrf_token req %> ... </form>
That's a good idea! It would bypass having to maintain arguments of form_tag
. The actual function would have to be Dream.csrf_tag
, since the existing Dream.csrf_token
generates a general CSRF token which might be used for CSRF schemes not involving form fields, and since we do probably want to generate the entire CSRF form field, as your snippet suggests.
If you do that in a PR, I suggest not removing Dream.form_tag
. I'll add an informative deprecation message to it later, to help people find out what to replace it with. I'll remove Dream.form_tag
after one or a few more releases.
Sounds like a plan! I'll draw up a PR soon.