How I use HTMX with Go

Re:How I use HTMX with Go by foldr on Wednesday July 15, 2026 @10:53AM (#48921780)

Will it not need unsafe-eval, though? It still creates the potential for HTML injection to lead to execution of untrusted code. Execution of untrusted code is the real issue, regardless of exactly how that code ends up being evaluate and executed. Even if Hyperscript were to have its own interpreter (so that it didn't even need unsafe-eval), you'd still have the same fundamental vulnerability (unless you add nonces, or some such).

>the risk from Hyperscript is not greater than any other JavaScript in the application.

This is not really the case. If all of your JS code is loaded via <script src="..."> tags from bundles on your server, and you have a CSP that blocks unsafe-eval or unsafe-inline, then you have a pretty good barrier against execution of untrusted code on your page.

[ Parent | on HN ]

Re:How I use HTMX with Go by Abishek_Muthian on Wednesday July 15, 2026 @12:56PM (#48923778)

AFAIK Hyperscript doesn't require `unsafe-eval`, when the optional features of htmx like `hx-on:*`, `hx-vals js:`, `hx-confirm js:` is used it required the `unsafe-eval` but now there's extension[1] to use even that without compromising on strict CSP through nonce.

[1] https://four.htmx.org/extensions/hx-csp

[ Parent | on HN ]

Re:How I use HTMX with Go by foldr on Wednesday July 15, 2026 @02:50PM (#48925387)

That’s interesting, thanks. I agree that with all those extra protections enabled, there is no security issue.

[ Parent | on HN ]