https://htmx.org logo
Powered by
# htmx-general
  • m
    I could use 
    disable-scripting
    for both...
  • m
    🤔
  • m
    htmx doesn't really feel like scripting to me though
  • m
    hx-disable-htmx
    seems excessive, and 
    hx-disable
    seems unclear to me...
  • m
    🤔
  • g
    hx-inert
  • m
    😑
  • s
    I dont see why hx-disable is unclear?
  • m
    i am not sure I do either
  • m
    ok, switched to 
    hx-disable
  • b
    Great!
  • b
    The last sentence in this paragraph sounds a bit confusing, any chance you could clarify? I'm happy to help clarify in the site once I get what you are trying to say.
  • b
    > Note that it is important to understand that htmx does not use eval for most of its features. You (or your security team) may use a CSP that disallows inline scripting. This will have no effect on htmx functionality, and is almost certainly not what you (or your security team) intends.
  • b
    Specifically, "and is almost certainly not what you (or your security team) intends".
  • b
    Ok, after re-reading that paragraph a few times I think I see what you mean... since htmx does not rely on inline scripting, disabling it with a CSP does not ensure that htmx will not execute JavaScript code.
  • b
    And therefore 
    hx-disable
    becomes relevant 🙂
  • m
    yes
  • m
    plz edit
  • m
    that's more relevant for hyperscript, where people might assume a strict CSP that forbids inline scripting would disable hyperscript
  • m
    but it also applies to htmx to an extent, in that you could inject htmx to make ajax calls even though eval isn't being used
  • m
    htmx 1.3.4 and hyperscript 0.0.9 dropping tomorrow
  • b
    That's great, just wondering where 1.3.3 went to, or did I miss something?
  • b
  • s
    Built a Note-taking app using Markdown with htmx inspired by the React Server components demo Demo: https://htmx-notes.herokuapp.com/ Code: https://github.com/rajasegar/htmx-notes
  • t
    btw, how do i grab input's value where htmx is bound?
  • t
    Copy code
    <input type="text"
                       name="search" placeholder="Type the tags"
                       hx-ext="debug"
                       hx-post="https://my.gallery?json=1&tags=???"
                       hx-trigger="keyup changed delay:500ms"
                       hx-target=".gallery__results">
  • m
    htmx should automatically include the value of the input that the request comes from
  • m
    another killer demo!
  • m
    I think I may have accidentally over-bumped it. It's been a long week.
  • m
    thank you!
1...209210211...1146Latest