Requests and responses

Inspect HTMX request headers

Use HX-Request and related headers as rendering context without treating them as proof of identity or permission.

8 minute lesson

~~~

HTMX sends request context in HX-* headers. Open the Network panel and look for:

  • HX-Request: true
  • HX-Trigger: the triggering element’s ID, when it has one
  • HX-Trigger-Name: its name, when present
  • HX-Target: the target’s ID, when present
  • HX-Current-URL: the browser’s current URL
  • HX-Boosted: true for a boosted request
  • HX-History-Restore-Request: true after a history cache miss

The server can use these as rendering context. HX-Request often selects fragment versus full-page output. HX-History-Restore-Request tells the route that history restoration needs enough HTML to reconstruct the page.

Do not make correctness depend on optional IDs. If HX-Target is absent, the route should still have a sensible representation.

Every one of these headers can be forged by a script or command-line client. They do not prove identity, permission, CSRF validity, or that the request originated from your markup.

Copy the request as curl, change HX-Target, and send it again. The response may render differently; authorization must not.

Lesson completed