I get that error for post routes but not for gets. Logging in again does not help.

Seeing the middleware document string now

Got to go to work now will fix later

Looks like eelchat solves it with an hx header for all hx requests.

I guess I should just use HX for all posts

yes, the error most likely means the anti forgery token isn't being included in the request at all. for non-htmx posts, you can use biff/form which inserts the token into a hidden input field .

Thanks.