Additional functions

[rmrhz]

Instead of directly outputting HTML from ::init. It should only output from a function call. I would be considering future interoperability in later changes to the package.

[JASchilz]

If I understand the issue correctly, you're saying that the interface for CSRF should be something like:

1. Start an output buffer using some method or function (currrently ::init)
2. Once you're ready to output, then call some method or function to process the output buffer and return modified HTML. Then the caller can print it if they so choose.

Advantages might be:

1. More modular: you give the caller the choice of what to do with the data.
2. More straightforward interface/less magic?

I agree that in general that's the proper way to do it.

I will note that ::init doesn't currently output HTML. What happens is that it initiates an output buffer with an associated filter, and when the page call is finished an PHP is closing the output buffers, the filter gets invoked and inserts a token automatically.

The consideration which led me to the current design is that this module fits into a larger framework (Athens) with I've targeted towards less-experienced programmers. Athens includes a "template" project which includes the call to CSRF::init in the setup. So the CSRF token gets inserted automatically without the less-experienced programmer having to remember to invoke another method in each page.

If I do understand your issue correctly, then given the consideration above I'll stick with the current design.

[rmrhz]

I fully understand now, lets just keep this issue as reference if you may consider changing the design in a later date. I'll also look into your framework as well if I can contribute

[JASchilz]

Roger! Given that, I'm going to note in the Athens docs that it's very
alpha. (:

I expect a 1.* release in the next few months; until then there will be a
lot of changes. But once I hit 1.* I will definitely appreciate and be
seeking feedback!

On Jul 20, 2016 3:52 PM, "rmrhz" notifications@github.com wrote:

I fully understand now, lets just keep this issue as reference if you may
consider changing the design in a later date. I'll also look into your
framework as well if I can contribute

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#3 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AF2ocMzHpYjhqoKhIUO-YXTfLlLWzMULks5qXqaxgaJpZM4JQVq1
.