The page shell as a set of slots the host fills (SPEC §13): :lang,
:title, :head, :header, :nav, :identity, :content, :footer.
It is an ordinary layout — a function of one slot map — usable as the
outermost entry of a route's :wb/layouts or called by the host's own
layout. Absent slots emit nothing.
What the shell reads from :request, when the request carries it: the
stylesheets of the config's :stylesheets and its plugins, linked after the base's
own and before :head; the negotiated locale for lang (SPEC §14), the CSP nonce for its own script
tag and the CSRF token, sent on every htmx request as X-CSRF-Token
through hx-headers:inherited on <body> (SPEC §15) — htmx 4 inherits
nothing without the modifier. A <script> the host adds through :head
needs its own nonce attribute, read from (:wb/nonce request).
The token goes on <body> only when the page uses it: when the rendered body
carries an htmx attribute (hx-… or data-hx-…), or when its content already
read the token for a form. Reading it is what writes it into the session, so a
page with neither — a public page, crawled — leaves no session behind. The body
is rendered before that decision, so a form or an htmx attribute inside lazy
content counts. What it cannot see is htmx reached from a script
(htmx.ajax, fetch) on a page with neither, or attributes under a prefix the host
configured for htmx in place of data-hx-: such a page reads security/csrf-token
itself, into a meta of :head.
The page shell as a set of slots the host fills (SPEC §13): `:lang`, `:title`, `:head`, `:header`, `:nav`, `:identity`, `:content`, `:footer`. It is an ordinary layout — a function of one slot map — usable as the outermost entry of a route's `:wb/layouts` or called by the host's own layout. Absent slots emit nothing. What the shell reads from `:request`, when the request carries it: the stylesheets of the config's `:stylesheets` and its plugins, linked after the base's own and before `:head`; the negotiated locale for `lang` (SPEC §14), the CSP nonce for its own script tag and the CSRF token, sent on every htmx request as `X-CSRF-Token` through `hx-headers:inherited` on `<body>` (SPEC §15) — htmx 4 inherits nothing without the modifier. A `<script>` the host adds through `:head` needs its own `nonce` attribute, read from `(:wb/nonce request)`. The token goes on `<body>` only when the page uses it: when the rendered body carries an htmx attribute (`hx-…` or `data-hx-…`), or when its content already read the token for a form. Reading it is what writes it into the session, so a page with neither — a public page, crawled — leaves no session behind. The body is rendered before that decision, so a form or an htmx attribute inside lazy content counts. What it cannot see is htmx reached from a script (`htmx.ajax`, `fetch`) on a page with neither, or attributes under a prefix the host configured for htmx in place of `data-hx-`: such a page reads `security/csrf-token` itself, into a `meta` of `:head`.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |