You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
This is kind of a bug, but also a feature. We are seeing the thymeleaf tag engine is not doing normal "spring things" like CSRF tags. I tracked this down to the FF4J servlet explicitly calling out to use the TemplateEngine instead of SpringTemplateEngine. I understand not everyone using ff4j-web is using spring, so this is a feeler on how we can make this work for both Spring users and non-Spring users.
Describe the solution you'd like
I'd like the ff4j spring boot config to use the SpringTemplateEngine so it auto-injects the CSRF tokens. I assume this would possibly require a change in the ff4j-web project to allow such customization. With that said, it doesn't seem too far-fetched to allow a runtime config for which template engine to use.
Describe alternatives you've considered
I have a hacky workaround right now doing a sed command in my Dockerfile and adding the CSRF hidden inputs in.
Thanks!
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
This is kind of a bug, but also a feature. We are seeing the thymeleaf tag engine is not doing normal "spring things" like CSRF tags. I tracked this down to the FF4J servlet explicitly calling out to use the
TemplateEngine
instead ofSpringTemplateEngine
. I understand not everyone usingff4j-web
is using spring, so this is a feeler on how we can make this work for both Spring users and non-Spring users.https://github.com/ff4j/ff4j/blob/main/ff4j-web/src/main/java/org/ff4j/web/FF4jServlet.java#L180
Describe the solution you'd like
I'd like the ff4j spring boot config to use the
SpringTemplateEngine
so it auto-injects the CSRF tokens. I assume this would possibly require a change in theff4j-web
project to allow such customization. With that said, it doesn't seem too far-fetched to allow a runtime config for which template engine to use.Describe alternatives you've considered
I have a hacky workaround right now doing a
sed
command in my Dockerfile and adding the CSRF hidden inputs in.Thanks!
The text was updated successfully, but these errors were encountered: