Hacker News Reader

I think this is a great example of all the small details we take for granted in the tools we use, and we would miss without realising when following these tips.

View on HN

That hidden CSRF field can be added without form_with though, and Rails still protects against not including it. I left it out of the example as it didn't seem relevant

Yes, it can be added, but manually going over all form. Also, how would it protect against a CSRF without the token in place?

Note: I totally agree that we should strive to go HTML first. However, this specific example is a bit unfair.

Reply on news.ycombinator.com