This HTMX article on security says it’s not ok to call HTMX with external sources.
Where does it say that? It says “Only call routes you control”. As I understood you, you do control those routes.
Welcome to the web development community! This is a place to post, discuss, get help about, etc. anything related to web development
Web development is the process of creating websites or web applications
Some webdev blogs
Not sure what to post in here? Want some web development related things to read?
Heres a couple blogs that have web development related content
This HTMX article on security says it’s not ok to call HTMX with external sources.
Where does it say that? It says “Only call routes you control”. As I understood you, you do control those routes.
Hypermedia APIs (i.e. HTML) are specific to the layout of your application, so there is almost never any reason you’d want to insert someone else’s HTML into your page. All you have to do is make sure you only call your own routes (htmx 2 will actually disable calling other domains by default).
Although I do control the routes, its seems like it's not common. One way is a reverse proxy so the component server is forwarded on /components path on the client. So the client can still call relative routs.
If you expect end users to regularly generate components for endpoints neither you nor they control, I think htmx is a poor match for your use case. Can you generate a vanilla web component that uses fetch instead?
I think I should clarify: This isn't a public library (yet). It's a system I'm creating in our company for usage within our products.
I thought about web components and actually created a few. But this hypermedia approach with HTMX is much simpler to develop and maintain, and since some of the components are very heavy, the server side rendering takes load off of clients and makes complex renderings possible.
Can you elaborate why do you think HTMX doesn't fit this usage? With webcomponents, the flow will be like this:
With this hypermedia approach the flow looks like this