The page shell as a set of slots the host fills (SPEC §13): :lang,
:title, :head, :scripts, :header, :nav, :identity, :content, :footer.
It is an ordinary layout — a function of one slot map — usable as the
outermost entry of a route's :wb/layouts or called by the host's own
layout. Absent slots emit nothing.
What the shell reads from :request, when the request carries it: the
stylesheets of the config's :stylesheets and its plugins, linked after the base's
own and before :head; the negotiated locale for lang (SPEC §14), the CSP nonce for its own script
tag and the CSRF token, sent on every htmx request as X-CSRF-Token
through hx-headers:inherited on <body> (SPEC §15) — htmx 4 inherits
nothing without the modifier. :scripts — local paths, after the route's own
:wb/scripts — is a deferred <script> each, under the request's nonce (since
0.22.0); a <script> the host writes into :head itself needs its own nonce.
The token goes on <body> only when the page uses it: when the rendered body
carries an htmx attribute (hx-… or data-hx-…), or when its content already
read the token for a form. Reading it is what writes it into the session, so a
page with neither — a public page, crawled — leaves no session behind. The body
is rendered before that decision, so a form or an htmx attribute inside lazy
content counts. What it cannot see is htmx reached from a script
(htmx.ajax, fetch) on a page with neither, or attributes under a prefix the host
configured for htmx in place of data-hx-: such a page puts security/csrf-meta in
:head, which reads the token.
The page shell as a set of slots the host fills (SPEC §13): `:lang`, `:title`, `:head`, `:scripts`, `:header`, `:nav`, `:identity`, `:content`, `:footer`. It is an ordinary layout — a function of one slot map — usable as the outermost entry of a route's `:wb/layouts` or called by the host's own layout. Absent slots emit nothing. What the shell reads from `:request`, when the request carries it: the stylesheets of the config's `:stylesheets` and its plugins, linked after the base's own and before `:head`; the negotiated locale for `lang` (SPEC §14), the CSP nonce for its own script tag and the CSRF token, sent on every htmx request as `X-CSRF-Token` through `hx-headers:inherited` on `<body>` (SPEC §15) — htmx 4 inherits nothing without the modifier. `:scripts` — local paths, after the route's own `:wb/scripts` — is a deferred `<script>` each, under the request's nonce (since 0.22.0); a `<script>` the host writes into `:head` itself needs its own `nonce`. The token goes on `<body>` only when the page uses it: when the rendered body carries an htmx attribute (`hx-…` or `data-hx-…`), or when its content already read the token for a form. Reading it is what writes it into the session, so a page with neither — a public page, crawled — leaves no session behind. The body is rendered before that decision, so a form or an htmx attribute inside lazy content counts. What it cannot see is htmx reached from a script (`htmx.ajax`, `fetch`) on a page with neither, or attributes under a prefix the host configured for htmx in place of `data-hx-`: such a page puts `security/csrf-meta` in `:head`, which reads the token.
(page {:keys [lang title head scripts header nav content footer request]
who :identity})cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |