Hacker News new | ask | show | jobs
by Abishek_Muthian 16 days ago
AFAIK Hyperscript doesn't require `unsafe-eval`, when the optional features of htmx like `hx-on:*`, `hx-vals js:`, `hx-confirm js:` is used it required the `unsafe-eval` but now there's extension[1] to use even that without compromising on strict CSP through nonce.

[1] https://four.htmx.org/extensions/hx-csp

1 comments

That’s interesting, thanks. I agree that with all those extra protections enabled, there is no security issue.