Handle redirects when htmx == True

In a project I’m working on we logout priviliged users after some time. This has the downside of returning a HttpResponseRedirect when issuing a htmx request, ie. when a user tries to use an already open browser tab the next day.

For now we have solved the problem by writing the following middleware:

class HtmxRedirectMiddleware:
    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        if request.htmx and isinstance(response, HttpResponseRedirect):
            # Set the HX-Redirect to the current location to imitate a reload
            response["HX-Redirect"] = response["Location"]
            # htmx only accepts 200's
            response.status_code = 200
        return response

This tells htmx to do a complete reload of the page leading to a redirect to the login page.

I think that the above approach might be a bit too generic - do we want to issue a redirect every time? For now it serves us fine since we are evaluating htmx in a small portion of our project.

The question is whether django-htmx should offer something similar?

[mfisco]

I’m also working on a project where the majority requests require authentication. For the time being we simply customized django’s LoginView

class AccountLoginView(LoginView):
    template_name = "accounts/login.html"

    def get(self, request, *args, **kwargs):
        """
        Triggers client-side redirect for htmx requests redirected to the login page.
        
        - Particularly useful when a user's session has expired but their client 
        is polling for a resource needing authentication. 

        """
        if request.htmx and REDIRECT_FIELD_NAME in request.GET:
            return HttpResponseClientRedirect(settings.LOGIN_URL)
        return super().get(request, *args, **kwargs)

Anyways, has there been any more ideas or thought given to adding this functionality to django-htmx?

[adamchainz]

I think that the above approach might be a bit too generic - do we want to issue a redirect every time?

This is my concern too. A server redirect isn’t necessarily a call for an HTMX redirect…

Ideally you’d instead update your “if not logged in then redirect” code to generate the correct response for htmx immediately, rather than modifying it after the fact. Of course that’s not always easy when you use e.g. django.contrib.auth.views.redirect_to_login.

I think we should let this one sit for a little, to think about it. I also hadn’t thought about not-logged-in requests so I will look at working with them in my project.