search

hotwired / turbo-rails

Use Turbo in your Ruby on Rails app
https://turbo.hotwired.dev
MIT License
2.13k stars 329 forks source link

Any Security Constraints to turbo_method: 'post' functionality? #648

Open jonmchan opened 4 months ago

jonmchan commented 4 months ago

I'm migrating from UJS to turbo, changing links from link_to "Activate Product", '/product/33/activate', method: 'post' to link_to "Activate Product", '/product/33/activate', { data: {turbo_method: 'post'}}. The link is from a page served from /admin/products/33. The turbo code will not honor the POST method unless I change the url to be from a similar parent location (/admin/products/33/activate works). Does turbo have any security constraints that prevents you from turning any link into a POST? Are others having this issue? Is this documented? Or am I the only one experiencing this?

p8 commented 2 weeks ago

You probably want to use button_to instead when doing a POST, PUT, DELETE. This makes sure it works without javascript and adds the autheticity_token to the form: https://edgeapi.rubyonrails.org/classes/ActionView/Helpers/UrlHelper.html#method-i-button_to