After debuggingvalid_authenticity_token?method inlib/action_controller/metal/request_forgery_protection.rbit seems the token check fails onvalid_per_form_csrf_token?(csrf_token)for the DELETE request, but succeeds when the method isPATCH

Most likely because

defper_form_csrf_token(session,action_path,method)#:doc:
csrf_token_hmac(session,[action_path,method.downcase].join("#"))
end

creates the token for the original method (PATCH) inform_withbut not for theformMethodon the button

Okay, so disabling per-form tokens fixes the issue:config.action_controller.per_form_csrf_tokens = false

Should that be documented in the guides about button'sformmethodattribute? Or maybe also a runtime warning? If so I can prepare a fix to the docs.

This works with Hotwire, because then it uses the global CSRF token from meta tags, not the method-specific one generated for this form.

This seems like a bug to me. Not only is the token generated using the wrong identifier (it uses the method in the form rather thanformmethod), but the request is also verified against a global CSRF token instead of a form-specific CSRF token.

I looked into the code, and fi xing this might not be straightforward. Theform_withmethod doesn’t have access to theformmethodattribute within the block. Moving theformmethodto theform_withmethod could be a simpler solution, but I’m not sure about the side effects. Let’s wait for the core team’s response.

If we can accessformmethodhere, we can override thehtml_options.

I think this could be approached in the opposite direction. When callingbuttonwith a:formmethodattribute, it could switch the form'sauthenticity_tokento a global one instead of form-specific. Because we can't have multiple tokens targetting different methods in one form and we don't know which submit button user might press

Moving the formmethod to the form_with method could be a simpler solution

That won't work IMO because one can have multiple submit buttons with differentformmethodvalues

@pokonskiYou are right. I wasn't aware of the use cases for multiple submit buttons. In that case, movingformmethodto theform_withmethod won't work.

This issue has been automatically marked as stale because it has not been commented on for at least three months.
The resources of the Rails team are limited, and so we are asking for your help.
If you can still reproduce this error on the7-2-stablebranch or onmain,please reply with all of the information you have about it in order to keep the issue open.
Thank you for all your contributions.