alpine

I really want to switch over to htmx, as I've moved away from SPAs frameworks, and I've been much happier. SPAs have so much abstraction, and modern, vanilla JavaScript is pretty decent to work with. The thing that keeps holding me back from htmx is that it breaks Content Security Policy (CSP), which means you lose an effective protection against XSS.[0] When I last asked the maintainer about this, the response was that this was unlikely to ever change.[1] Alpine.js, a similar project to htmx, claims to have a CSP-compatible version,[2] but it's not actually available in any official builds. [0] https://htmx.org/docs/#security [1] https://news.ycombinator.com/item?id=32158352 [2] https://alpinejs.dev/advanced/csp [3] https://github.com/alpinejs/alpine/issues/237

Yeah, this is the dealbreaker for me with alpine.js and htmx. And I wouldn't even say "tight CSP" as much as "standard CSP." To make alpine.js play nice with CSP, you have to allow unsafe-eval, which severely weakens your protection against XSS. alpine.js claims to have a compatibility build with CSP, but it's not officially available, doesn't fully work, and the parts that are broken in the CSP build aren't documented.[0] htmx works under CSP, but it opens a new vector for attackers to inject JS into your page, which effectively neuters CSP.[1] [0] https://github.com/alpinejs/alpine/discussions/1944 [1] https://htmx.org/docs/#security