News for hackers. Stuff that matters.

A comment on Htmx does not play well with content security policy. Parent comment

Re:Htmx does not play well with content security policy by elmigranto on Tuesday July 02, 2024 @07:53AM (#40855731)
> if someone manages to inject arbitrary HTML

If they can, why wouldn’t it be inline <script>?

[ Parent | on HN ]
Re:Htmx does not play well with content security policy by amluto on Tuesday July 02, 2024 @07:57AM (#40855759)
Because CSP can be configured to block inline scripts.
[ Parent | on HN ]
Re:Htmx does not play well with content security policy by jsheard on Tuesday July 02, 2024 @08:00AM (#40855779)
The syntax to allow inline scripts is even "unsafe-inline" to emphasize that you are entering the danger zone.
[ Parent | on HN ]