Version 0.4.3 of Braindump, I Need More Functional Tests.
Yesterday, I shipped a new release of braindump. It was awesome. Until I tried to use it this morning and realized that notes were no longer being saved when you edit them. So today I cut a new release that fixes that bug, as well as implementing a new feature where you can see what notes you have shared in the past. This also addresses an issue with sharing notes, so you should be able to send notes via email again. Normally, when a product is being released on a regular cadence it is exciting. In this case, it just means that I really need more functional tests.
Post Mortem of Note Saving Bug
For those who are curious, I will document what happened in the hopes that it does not affect others in the future. Braindump was originally written using WTForms, which has CSRF protection built in so you don't have to think about it. Recently, I have begun transitioning away from WTForms in lieu of regular forms that are submitted via AJAX. The most visible benefit is that you can see and edit all of your notes from the main page, instead of having to click into each note in order to edit it. After switching to AJAX, I quickly realized that I was no longer sending a CSRF token with POST and PUT requests, which is probably a bad thing. I enabled it in the previous release. Even though I got this to work in the login and registration modal (which are true forms), I didn't consider the PUT request when editing a note. This is not a form at all, but a method that fires whenever you stop typing. Naturally, since there was no token and the endpoint was not marked as exempt, the response was a 400 error (missing CSRF token). My solution was to add the token as a meta tag to every page, and then send it along in the request headers of the AJAX call.Enable CSRF
// app/__init__.pycsrf = CsrfProtect()
def create_app(config_name): … csrf.init_app(app) …
return app
Token in the Header
// app/templates/app/app_base.html // This works because csrf_token() is in the global scope.<meta name=“csrf-token” content=" csrf_token() " />
AJAX Method to add the token before sending the PUT request.
// frontend/js/src/braindump.editor.jssaveNote: function(id, content) {
var csrftoken = $('meta[name=csrf-token]').attr('content') $.ajax({ beforeSend: function(xhr) { xhr.setRequestHeader("X-CSRFToken", csrftoken) }, url: `/edit/<span class="cp">${</span><span class="nb">id</span><span class="cp">}</span>`, data: JSON.stringify({ 'body': content, }), contentType: 'application/json', type: 'PUT', success: function (response) { console.log(response); }, error: function (error) { console.error(error); } });
},
Thank you for reading! Share your thoughts with me on bluesky, mastodon, or via email.
Check out some more stuff to read down below.
Most popular posts this month
- Everything wrong with developer tools in a single paragraph
- SQLite DB Migrations with PRAGMA user_version
- Urge to Edit Old Posts
- Setting up ANTLR4 on Windows
- Reinstalling Windows at 1am
Recent Favorite Blog Posts
This is a collection of the last 8 posts that I bookmarked.
- 21st Century C++ from Communications of the ACM
- Submarines DevCon 2025 Keynote Speech from JoshHaines.com
- How I Use AI: Meet My Promptly Hired Model Intern from Armin Ronacher's Thoughts and Writings
- DeepSeek from Maggie Appleton
- Digital Reality Digital Shock from Christopher Butler
- 10 habits to help becoming a Debian Maintainer from Optimized by Otto
- Tiny corners from Manuel Moreale RSS Feed
- Build It Yourself from Armin Ronacher's Thoughts and Writings
Articles from blogs I follow around the net
“Stop calling it work” – Cedric Raguenaud
Cedric Raguenaud argues that.. “When we label our photographic pursuits as “work,” we unconsciously impose constraints and expectations that belong in the professional world. Suddenly, we feel pressured to maintain visibility, chase originality, and demon…
via Colin Devroe February 10, 2025The Art of Making Websites
Hidde de Vries gave a great talked titled “Creativity cannot be computed” (you can checkout the slides or watch the video). In his slides he has lots of bullet points that attempt to define what art is, and then in the talk he spends time covering each one…
via Jim Nielsen’s Blog February 10, 2025Corporate “DEI” is an imperfect vehicle for deeply meaningful ideals
I have not thought or said much about DEI (Diversity, Equity and Inclusion) over the years. Not because I don’t care about the espoused ideals — I suppose I do, rather a lot — but because corporate DEI efforts have always struck me as ineffective and blan…
via charity.wtf February 10, 2025Generated by openring