quarkiverse / quarkus-renarde

Server-side Web Framework with Qute templating, magic/easier controllers, auth, reverse-routing
Apache License 2.0
73 stars 16 forks source link

Enforce that it's the actual redirect request that get the flash data #192

Open ia3andy opened 5 months ago

ia3andy commented 5 months ago

I managed to reproduce a bug (consistently) that I've been experiencing for a while with htmx and flashes.

Essentially, if a request with a redirect (which flashes the htmx) occurs, and for some reason, the browser does not consume the redirect, the next request (which is unrelated) use the wrong flashed (and is returned as htmx). The problem can also occur with errors.

I think it's essential to have a way to enforce that it's the redirect that triggers the flash (and not a different request).

I'm not sure how to best achieve that, probably a flag query in the redirect URL (?flash-id=37336464647474)?

It would have been better with a silent way to enforce it but we don't control headers of the redirect, so I don't really see any alternative.