Advanced Hotwire security
This course looks at the places in a Hotwire application where work leaves the request you pictured. It shows what a broadcast renders without a request, session or current user, and why nothing per-viewer belongs in a broadcast partial. It covers Content Security Policy nonces with importmap, CSRF tokens in Turbo submissions and hand-written fetch calls, prefetch requests fired on hover, and morphing with DOM identity. It closes with frames, origins, data attributes as untrusted input and a checklist of six questions.
What you'll learn
- ✓Why broadcast partials render with no request, session or current user
- ✓How refresh broadcasts let each subscriber re-fetch under its own session
- ✓What a CSP nonce protects and why importmap needs one
- ✓How Turbo sends the CSRF token and what your own fetch must do
- ✓Why prefetch turns state-changing GETs into hover-triggered actions
- ✓How morphing preserves DOM nodes and why frames and data attributes need care
The Hotwire attack surface
A background job renders a partial. Nobody is logged in inside that job, because nobody is anything inside a job. The partial asks for the current user, gets nil and renders the signed-out version of a card. Action Cable sends that same HTML to every browser subscribed to the stream.
Read the full lesson free →Curriculum
7 lessonsThe Hotwire attack surface
Introduces four moments where Hotwire work leaves the request: broadcast jobs, hovers, morphs and frames.
What a broadcast renders without
Shows that broadcasts render through ApplicationController.render with no request, session or user, and why refresh broadcasts avoid it.
CSP and the nonce Hotwire needs
Explains why an importmap application needs a CSP nonce, what a nonce protects and how to evaluate a generator.
CSRF, Turbo, and your own fetch
Covers how Turbo sends the CSRF token, why hand-written fetch calls must set it, and cached form problems.
Prefetch issues real requests
Explains that Turbo prefetch sends real GET requests on hover, why state-changing GETs are dangerous, and how to opt out.
Morphing and DOM identity
Describes how morphing merges the DOM, how idiomorph matches nodes by id, and why preserved nodes matter for security.
Putting it together: frames, origins, and untrusted DOM
Covers frames as delegated fetches, data attributes as untrusted input, and a six-question checklist for Hotwire features.