3 ms·

Probably yes if you use the inline event handler feature it has. https://htmx.org/essays/web-security-basics-with-htmx/#bonus-content-security-policy https://h

• seanwilson 3y ago
  From the link: > Some htmx applications make use of inline scripting—the hx-on attribute is a generalized attribute listener that can evaluate arbitrary scripts (although it can be disabled if you don’t need it). Sometimes inline scripts are appropriate to preserve locality of behavior on a application that is sufficiently secured against XSS, sometimes inline scripts aren’t necessary and you can adopt a stricter CSP. It all depends on your application’s security profile—it’s on to you to be aware of the options available to you and able to perform that analysis. Is hx-on required often? How clunky does it get to avoid hx-on everywhere?