Not getting any CSRF token in html output

[asio]

I have a roda app where I'm trying to add forme with forme_route_csrf token.

In my app.rb I have the following plugins:

  plugin :route_csrf
  plugin :forme
  plugin :forme_route_csrf

Also defined this method for generating the form:

  def family_form(family)
    Forme.default_config = :bs5

    form_attr = {method: 'post', action: '/family/add'}
    form_opts = {:config=>:bs5, csrf: true }

    Forme.form(family, form_attr, form_opts) do |f|
      f.inputs(:legend=>'New Family') do
        f.input(:address)
        f.input(:postal_code)
        f.input(:city)
        f.input(:build_sponsor, type: :date)
      end
      f.button(:value=>'Save')
    end
  end

And in my erb template I call it like this:

<%== family_form(@family) %>

The resulting html looks like this:

<form action="/family/add" class="forme family" method="post">
    <fieldset class="inputs">
        <legend>New Family</legend>
        <div class="string required">
            <label class="form-label label-before" for="family_address">Address<abbr title="required">*</abbr></label>
            <input class="form-control" id="family_address" name="family[address]" required="required" type="text" />
        </div>
        <div class="string required">
            <label class="form-label label-before" for="family_postal_code">Postal code<abbr title="required">*</abbr></label>
            <input class="form-control" id="family_postal_code" name="family[postal_code]" required="required" type="text" />
        </div>
        <div class="string required">
            <label class="form-label label-before" for="family_city">City<abbr title="required">*</abbr></label>
            <input class="form-control" id="family_city" name="family[city]" required="required" type="text" />
        </div>
        <div>
            <label class="form-label label-before" for="family_build_sponsor">Build sponsor</label>
            <input class="form-control" id="family_build_sponsor" name="family[build_sponsor]" type="date" />
        </div>
    </fieldset><input class="btn btn-primary" type="submit" value="Save" />
</form>

What I'm I missing that I don't get any csrf token in the generated html

[janko]

I think you need to use the Roda view helper that ships with Forme. Otherwise Forme doesn't have access your Roda instance, which it would use to generate the CSRF token.

[asio]

yes replacing Forme.form with just form solved the csrf problem, but introduced a new one. I was following this part of the readme forme_set Usage.

Form method:

  def family_form(family, action = '/family/add')
    form_attr = ATTRIBUTES.merge({ action: action })

    form(family, form_attr, OPTS) do |f|
        f.input(:address)
        f.input(:postal_code)
        f.input(:city)
        f.input(:build_sponsor, type: :date)
      f.button(:value=>'Save')
    end
  end

Route:

      r.get 'add' do
        @family = Family.new

        view('add')
      end

View(add):

<%= family_form(@family) %>

And the resulting HTML:

<form action="/family/add" class="forme family" method="post"><input name="_csrf" type="hidden" value="Yv4+CHeFjlzZJ2/fntm0AMUTs2V4tmByBTUGseZvrjMUCi0rPVeSik8m3rWDlZEaHj1U9vIcewUUCPGPmFv7"/></form>&lt;form action=&quot;/family/add&quot; class=&quot;forme family&quot; method=&quot;post&quot;&gt;&lt;input name=&quot;_csrf&quot; type=&quot;hidden&quot; value=&quot;Yv4+CHeFjlzZJ2/fntm0AMUTs2V4tmByBTUGseZvrjMUCi0rPVeSik8m3rWDlZEaHj1U9vIcewUUCPGPmFv7&quot;/&gt;&lt;/form&gt;

Looks like it generates two form tags where the first one only contains the csrf token and the second one all tags are escaped but still only csrf token no other elements

[jeremyevans]

The way the Roda form support works, you are supposed to do:

<% form_attr = ATTRIBUTES.merge({ action: action }) %>
<% form(@family, form_attr, OPTS) do |f| %>
        <%== f.input(:address) %>
        <%== f.input(:postal_code) %>
        <%== f.input(:city) %>
        <%== f.input(:build_sponsor, type: :date) %>
        <%== f.button(:value=>'Save') %>
<% end %>

When passing a block to form, the opening form tag, csrf tag, and closing csrf tag are added directly to the backing template. You appear to be using Roda's auto escaping support (good), so you need <%== so you don't escape the HTML code that Forme generates (Forme already escapes the values inside the HTML it returns).

I think it should be possible to make it so your code works by passing an option not to add the opening form tag, csrf tag, and closing csrf tag are added directly to the backing template. You would still need to use <%== family_form(@family) %> in that case. I'll see if I can work on that in the future.

[jeremyevans]

@asio I pushed b0453b1, which should allow you to do form(family, form_attr, emit: false) do |f| inside family_form and have your code work with no other changes. Can you try that and report whether it works for you?

[asio]

Yes setting emit: false and using form instead of the originally used Forme.form solved my problems. Now it generates html with all fields and the csrf token as expected

[jeremyevans]

Great, thank you for confirming!