Skip to content

Prevent slow turbo frame requests from resetting cookies #1399

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

domchristie
Copy link
Contributor

This pull request fixes an issue where slow turbo-frame requests can inadvertently reset cookies.

For example, let's say we have a form that changes the session and a <turbo-frame> that loads a slow endpoint:

<form method="post" action="/session">
  <button type="submit">Change Session</button>
</form>

<turbo-frame id="slow" src="/slow"></turbo-frame>

Here's a potential flow:

  1. Page loads, <turbo-frame> starts loading
  2. User taps "Change Session"
  3. That request completes and the session cookie is updated
  4. <turbo-frame> request completes later and resets the session cookie to what it was in step 1.

Reproduction: https://github.com/domchristie/turbo_frame_cookies_test

The fix is to cancel the frame's current fetch request when the <turbo-frame> disconnects.

@domchristie
Copy link
Contributor Author

Recursive <turbo-frames> look like they rely on the current behaviour. I've updated the disconnect flow to account for this, but it's not the prettiest.

@domchristie domchristie force-pushed the turbo_frame_cookies branch 2 times, most recently from 0a52d07 to 017ccd0 Compare April 16, 2025 09:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

1 participant