Turbo frame request is removing the csrf meta tag

[noctivityinc]

When doing a simply turbo frame request via a link click, we are noticing the CSRF meta tag is REMOVED from the page!? We are having to do this hack to get it back, which I don't love and seems like a bug:

document.addEventListener("turbo:before-fetch-request", function (event) {
  window.csrfToken = document.querySelector("[name=csrf-token]").content;
  event.detail.fetchOptions.headers["X-CSRF-Token"] = csrfToken;
});

document.addEventListener("turbo:frame-load", function (event) {
  const csrfMetaTag = document.querySelector('meta[name="csrf-token"]');
  if (!csrfMetaTag) {
    const newCsrfMetaTag = document.createElement("meta");
    newCsrfMetaTag.name = "csrf-token";
    newCsrfMetaTag.content = window.csrfToken;
    document.head.appendChild(newCsrfMetaTag);
  }
});
``

[sfnelson]

We also ran in to this issue. It seems like a consequence of the change in Turbo 8 to treat frame navigations as full requests (with head). I've spent a lot of time investigating the code paths before for different reasons. See: hotwired/turbo#1047 e.g.

@seanpdoyle I think this is probably something that should be on your radar?

[seanpdoyle]

I've opened #697 in an attempt to resolve this issue.