this post was submitted on 28 Jul 2026
4 points (83.3% liked)

Web Development

5752 readers
73 users here now

Welcome to the web development community! This is a place to post, discuss, get help about, etc. anything related to web development

What is web development?

Web development is the process of creating websites or web applications

Rules/Guidelines

Related Communities

Wormhole

Some webdev blogsNot sure what to post in here? Want some web development related things to read?

Heres a couple blogs that have web development related content

CreditsIcon base by Delapouite under CC BY 3.0 with modifications to add a gradient

founded 3 years ago
MODERATORS
 

cross-posted from: https://programming.dev/post/54211132

Hi people. I'm creating a system using HTMX
It's a server using clj-kit, which renders "components" using hiccup and HTMX based on the requests.
A component generator basically. But it also has some JSON APIs which return pure data.

The details don't matter. It just exposes REST APIs, user calls REST API with their own custom params and get their custom component.

The goal is so this can be used for progressive rewrite and enhancement of legacy systems, and the components to be usable in multiple systems, reducing work.
In order for the user of the system to be able to use these components, they should also add HTMX to their client, and call the service. for example

<div hx-get="https://component.service/componentx?data-url=https%3A%2F%2Fdata.source%2Fdata" hx-trigger="load">

This is the architecture I thought of. Is this ok? This HTMX article on security says it's not ok to call HTMX with external sources. So what is the best way you suggest to create such system?

I'm halfway through it already, but I would like to hear what others have to say and your suggestions. Maybe HTMX isn't the right choice at all? I felt like it is.

Thank you.

top 4 comments
sorted by: hot top controversial new old
[–] Kissaki@programming.dev 1 points 10 hours ago (1 children)

This HTMX article on security says it’s not ok to call HTMX with external sources.

Where does it say that? It says “Only call routes you control”. As I understood you, you do control those routes.

[–] somegeek@programming.dev 1 points 7 hours ago

Hypermedia APIs (i.e. HTML) are specific to the layout of your application, so there is almost never any reason you’d want to insert someone else’s HTML into your page. All you have to do is make sure you only call your own routes (htmx 2 will actually disable calling other domains by default).

Although I do control the routes, its seems like it's not common. One way is a reverse proxy so the component server is forwarded on /components path on the client. So the client can still call relative routs.

[–] CombatWombat@feddit.online 1 points 10 hours ago (1 children)

If you expect end users to regularly generate components for endpoints neither you nor they control, I think htmx is a poor match for your use case. Can you generate a vanilla web component that uses fetch instead?

[–] somegeek@programming.dev 1 points 7 hours ago

I think I should clarify: This isn't a public library (yet). It's a system I'm creating in our company for usage within our products.

I thought about web components and actually created a few. But this hypermedia approach with HTMX is much simpler to develop and maintain, and since some of the components are very heavy, the server side rendering takes load off of clients and makes complex renderings possible.

Can you elaborate why do you think HTMX doesn't fit this usage? With webcomponents, the flow will be like this:

  1. Client fetch data from source
  2. Client render the data within tge component

With this hypermedia approach the flow looks like this

  1. The client requests component with data from source from server
  2. Server fetches the data, (possibly validates it)
  3. Server renders the component
  4. Server sends component to client