Thanks for sharing and for your work on intercooler.js and htmx! I share your sentiments about SPAs, and I've been trying to get back to a simpler web stack.

Thanks for sharing and for your work on intercooler.js and htmx! I share your sentiments about SPAs, and I've been trying to get back to a simpler web stack. One of the hurdles I keep running into with libraries like htmx and Alpine is that they don't play nicely with Content Security Policy. And I'm reluctant to forfeit CSP to use a JS library since CSP is the most robust solution I've found for preventing XSS. Alpine is working on a CSP-compatible build, but it hasn't been released[0] and doesn't seem to be a priority. htmx is compatible with CSP, but it effectively reverses the protection it offers. The attacker can inject JS through htmx directives.[1] I know there's hx-disable, but this degrades CSP's effect from "secure by default" to "secure when the developer remembers to mark the subtree as containing user-controlled data." Is there a way to use htmx without forfeiting the benefits of CSP? [0] https://github.com/alpinejs/alpine/issues/237#issuecomment-999692410 https://github.com/alpinejs/alpine/issues/237#issuecomment-9... [1] https://htmx.org/docs/#security https://htmx.org/docs/#security