HTTP Method Spoofing HTML Forms

In this lesson, we'll learn how we can enable HTTP Method Spoofing to allow AdonisJS to spoof intended HTTP Verbs for basic HTML form POST requests.

Published
Feb 17, 24
Duration
3m 3s

Developer, dog lover, and burrito eater. Currently teaching AdonisJS, a fully featured NodeJS framework, and running Adocasts where I post new lessons weekly. Professionally, I work with JavaScript, .Net C#, and SQL Server.

Adocasts

Burlington, KY

Join The Discussion! (2 Comments)

Please sign in or sign up for free to join in on the dicussion.

  1. Commented 3 days ago

    Is this really the only clean way to tell Edge to pass this request with a parameter to specify the method? I mean: add an empty object, then an object containing a property qs which is itself an object containing the method name... It's a bit verbose... or is it intentional?

    In a shorter way :

    action="{{ route('redis.flush') }}?_method=DELETE"
    Copied!

    But it might be nicer for DX to have a helper to do something like :

    action="{{ route('redis.flush').method('DELETE') }}"
    Copied!

    What do you think about this ?

    1

    Please sign in or sign up for free to reply

    1. Commented 2 days ago

      The second argument of the route method is where we'd add route parameters! So, if you need a route for:

      router.post('/movies/:id/activate', [MoviesController, 'activate']).as('movies.activate')
      Copied!

      You could use the route method in EdgeJS to generate it like so:

      <a href="{{ route('movies.activate', { id: 1 }) }}">
        Activate
      </a>
      Copied!

      The third argument is then additional config options, which includes qs to add to the URLs query string. So, there are other options you can include beyond qs to the third argument. Alternatives to this would include, as you've discovered, hard coding the query string outside the route method. You could also use the Route Builder, I believe you'd need to add this as a global to EdgeJS as I don't think it is included out of the box. However, the Route Builder would be AdonisJS solution to your second example!

      What I normally do, though, is wrap the route helper in my own service to make things super easy to read! For example, a usage of my form service would be:

      <form method="POST" action="{{ form.delete('redis.flush') }}">
      </form>
      Copied!

      You could also create EdgeJS components for this as well, which I've done in the past so you could do:

      @form.delete({ action: route('redis.flush') })
      @end
      Copied!
      1

      Please sign in or sign up for free to reply

Playing Next Lesson In
seconds