Update README.md

This commit is contained in:
Rob Wagner 2023-07-27 23:04:22 -04:00
parent 4aa5cd299d
commit d7f78687fe
No known key found for this signature in database
GPG key ID: 53CCB4497B15CF61

View file

@ -58,11 +58,10 @@ for the `HX-Request` header. This will return a `403: Forbidden` response if the
header is not present, which is useful if you want to make an entire router, say
`/api`, only accessible via htmx requests.
_It should be noted that this is NOT a replacement for authentication. A user
can trivially set the `HX-Request` header themselves. This is merely a
convenience for preventing users from receiving partial responses without full
context. If you need to secure an endpoint, you should be using a proper
authentication system._
_It should be noted that this is NOT a replacement for an auth guard. A user can
trivially set the `HX-Request` header themselves. This is merely a convenience
for preventing users from receiving partial responses without context. If you
need to secure an endpoint, you should be using a proper auth system._
## Example: Extractors