Support updating the antiforgery token when a boost occurs

[khalidabuhakmeh]

It can be problematic if a token has been used previously.

Note: This updates to HTMX 1.9.2 (the latest as of this commit). #15

[khalidabuhakmeh]

👋 @AlexZeitler @juchom Could I get a quick review for this PR?

This uses HTMX 1.9.2 to check if a request is boosted. That said, the JS should be written in a way that is a no-op for previous versions.

[juchom]

I've made some quick tests, and it works well.

Thanks for this quick fix.

[khalidabuhakmeh]

I'm not sure I had to replace the meta tag in the DOM, since htmx will use the entity in memory, but I did for the sanity of devs looking at the HTML markup.

We could revisit this, but this approach is decent for now. Waiting for feedback on the PR, but will try and get this out sooner than later.

[AlexZeitler]

@khalidabuhakmeh Sorry, I won't be able to review it before Friday in a way to give reasonable feedback.

[khalidabuhakmeh]

@AlexZeitler no worries, I believe @juchom can still use the JavaScript here to work around his issue. There's no rush. I just like a second set of eyes on this since folks are actually using it. 😱

[juchom]

@AlexZeitler, @khalidabuhakmeh thanks a lot, it will be done, when it's done !

This is very nice from you to fix it that fast 👍

[khalidabuhakmeh]

👋 Hey folks, I've added a new endpoint for the anti-forgery script, which allows for referencing the script in a <script src="" defer></script> tag. This is the better option using modern approaches for JavaScript.

I still left the old approach but left a message about the newer approach.

As a bonus 🎁: If you use this approach, you won't have to worry about registering event handlers multiple times on boost, since the script will only be loaded once per page. I left the JavaScript checks in place to account for the old way, but they are unnecessary using the endpoint approach.

[AlexZeitler]

LGTM

[khalidabuhakmeh]

It's going in boys and girls!