fast-twitch.util.anti-forgery

Render the field inside a protected handler

(ns application.forms
  (:require [fast-twitch.util.anti-forgery :refer [anti-forgery-field]]))

(defn form-view []
  [:form {:method "post" :action "/save"}
   (anti-forgery-field)
   [:input {:name "title"}]
   [:button {:type "submit"} "Save"]])

The helper returns Hiccup for a hidden input. Render this view while the anti-forgery wrapper's request bindings are active. The field name defaults to the bound parameter name or __anti-forgery-token; an options map may override :param-name. The value comes from the current bound token delay, not from the session cookie value.

An async renderer must capture those bindings before await; use the middleware's bound-anti-forgery-fn or capture request token/parameter values explicitly. Rendering a field alone does not validate POST requests or load sessions. Complete authenticated form project · Async token rendering.

Upstream function reference

View helpers for rendering anti-forgery form fields.

anti-forgery-field

(anti-forgery-field)
(anti-forgery-field options)

Function.

Returns a hidden form input populated with the current anti-forgery token. Source