ActiveRecord + Turbo Streams: Persisting Pagination State Across Reflex Calls

Goal

We want to display a large list of records in a Rails view using Reflex to update the list via Turbo Streams, while limiting the number of records per page and preserving the current page across multiple Reflex invocations.

Constraints

Reflex actions are stateless between requests; ActiveRecord scopes can bound a query with limit and offset, but the client does not automatically remember the page number when a Turbo Stream replaces the list. Without explicit state handling, the next “next page” click may reset to page 0 or produce inconsistent results.

Unresolved Decision

The community has not agreed on a standard pattern for persisting pagination parameters across Reflex calls. Options include storing the page number in the session, embedding it in a hidden field, or passing it as a parameter on every Reflex event. Each approach has trade‑offs in security, UX, and complexity.

Questions

1. What is the most secure way to transmit the current page number in a Reflex request without exposing it to tampering?
2. Should the page state be stored server‑side (e.g., session) or client‑side (e.g., hidden field) to maintain consistency?
3. How can we validate and sanitize pagination parameters to prevent injection or out‑of‑range errors?