Version 0.4.3 of Braindump, I Need More Functional Tests.

| programming | python | projects |

Yesterday, I shipped a new release of braindump. It was awesome. Until I tried to use it this morning and realized that notes were no longer being saved when you edit them. So today I cut a new release that fixes that bug, as well as implementing a new feature where you can see what notes you have shared in the past. This also addresses an issue with sharing notes, so you should be able to send notes via email again. Normally, when a product is being released on a regular cadence it is exciting. In this case, it just means that I really need more functional tests.

Post Mortem of Note Saving Bug

For those who are curious, I will document what happened in the hopes that it does not affect others in the future. Braindump was originally written using WTForms, which has CSRF protection built in so you don't have to think about it. Recently, I have begun transitioning away from WTForms in lieu of regular forms that are submitted via AJAX. The most visible benefit is that you can see and edit all of your notes from the main page, instead of having to click into each note in order to edit it. After switching to AJAX, I quickly realized that I was no longer sending a CSRF token with POST and PUT requests, which is probably a bad thing. I enabled it in the previous release. Even though I got this to work in the login and registration modal (which are true forms), I didn't consider the PUT request when editing a note. This is not a form at all, but a method that fires whenever you stop typing. Naturally, since there was no token and the endpoint was not marked as exempt, the response was a 400 error (missing CSRF token). My solution was to add the token as a meta tag to every page, and then send it along in the request headers of the AJAX call.

Enable CSRF

// app/__init__.py

csrf = CsrfProtect()


def create_app(config_name):
…
csrf.init_app(app)
…


return app

Token in the Header

// app/templates/app/app_base.html
// This works because csrf_token() is in the global scope.

<meta name=“csrf-token” content="  csrf_token() " />

AJAX Method to add the token before sending the PUT request.

// frontend/js/src/braindump.editor.js

saveNote: function(id, content) {


    var csrftoken = $('meta[name=csrf-token]').attr('content')

    $.ajax({
            beforeSend: function(xhr) {
                    xhr.setRequestHeader("X-CSRFToken", csrftoken)
            },
            url: `/edit/<span class="cp">${</span><span class="nb">id</span><span class="cp">}</span>`,
            data: JSON.stringify({
                    'body': content,
            }),
            contentType: 'application/json',
            type: 'PUT',
            success: function (response) {
                    console.log(response);
            },
            error: function (error) {
                    console.error(error);
            }
    });



},

Everything now works fine, and in the future if I need to make more AJAX calls, the token will be available in the meta of each page. This would have been easily caught if I had had even a single functional test. I hope to have something in place over the next few days so that I stop shipping breaking changes. Braindump is still very beta level software. Once we make it past the 1.0 release, I will have close to 100% code coverage, full functional test suite, and develop a steady pace for incremental improvements so that there are no more surprises like this one in the future.

Thank you for reading! Share your thoughts with me on bluesky, mastodon, or via email.

Check out some more stuff to read down below.

Most popular posts this month

Recent Favorite Blog Posts

This is a collection of the last 8 posts that I bookmarked.

Articles from blogs I follow around the net

Highlights from my conversation about agentic engineering on Lenny's Podcast

I was a guest on Lenny Rachitsky's podcast, in a new episode titled An AI state of the union: We've passed the inflection point, dark factories are coming, and automation timelines. It's available on YouTube, Spotify, and Apple Podcasts. Here …

via Simon Willison's Weblog: Entries April 2, 2026

Flood Fill vs the Magic Circle

Musings from Robin Sloan: Most olive oil production at medium-or-greater scale depends on machines of this kind [over-the-row olive harvester]; they trundle over trees planted in long rows, almost like continuous hedges, and collect the fruit with vibratin…

via Information Overload April 2, 2026

The Blandness of Systematic Rules vs. The Delight of Localized Sensitivity

Marcin Wichary brings attention to this lovely dialog in ClarisWorks from 1997: He quips: this breaks the rule of button copy being fully comprehensible without having to read the surrounding strings first, perhaps most well-known as the “avoid «click here»…

via Jim Nielsen’s Blog April 2, 2026

Generated by openring