Hacker News Reader

For the sake of being precise - the “form_with” is not equivalent to the presented HTML. The form_with helper injects an additional hidden input element that makes sure that the form cannot be submitted “illegally”.

View on HN

I think this is a great example of all the small details we take for granted in the tools we use, and we would miss without realising when following these tips.

That hidden CSRF field can be added without form_with though, and Rails still protects against not including it. I left it out of the example as it didn't seem relevant

Yes, it can be added, but manually going over all form. Also, how would it protect against a CSRF without the token in place?

Note: I totally agree that we should strive to go HTML first. However, this specific example is a bit unfair.

Reply on news.ycombinator.com