3 ms·
htmx Web Security Basics
- eddd-ddde 2y agoYou don't have to disable CORS to call routes on a different domain. Just configure your server properly so it knows which sites can have access to the routes. That's literally the whole point of CORS.
- indigodaddy 2y agoSo like for Python just use request referrer and then have some logic for allowed referrer/URLs on all routes or something like that? Or is that something you’d more want to do at the web server or proxy level like with gunicorn/nginx/caddy? I have gunicorn in front and have been doing similarly at the Python/route level
- bitexploder 2y agoThis is overthinking it: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS You configure it mostly in HTTP headers, generally at your HTTP server/static asset serving level.
- Joker_vD 2y agoOh, so you can use something other than * in Access-Control-Allow-Origin? That's good to know!
- indigodaddy 2y agoOk right so at web server or r. proxy level
- KronisLV 2y ago> If the server specifies a single origin (that may dynamically change based on the requesting origin as part of an allowlist) rather than the "*" wildcard, then the server should also include Origin in the Vary response header to indicate to clients that server responses will differ based on the value of the Origin request header. I dislike this about CORS, especially when you'd want to configure it at the web server/ingress level, but suddenly need dynamic logic to return the appropriate header, for example here's an older example I used when fronting some apps with Apache: https://stackoverflow.com/a/22331450 https://stackoverflow.com/a/22331450 I understand why it's in place (because you probably shouldn't leak all of the allowed domains), but dealing with that can be a bit awkward.
- bitexploder 2y agoYeah, browser security on the whole is surprisingly complicated. SameSite cookies, CORS, CORS Preflight, the in the weeds behaviors of many things are just invisible or not intuitive until you are deep into them.
- deisteve 2y agoanybody remember there was a library that combined htmx + alpinejs as one ?
- indigodaddy 2y agoAlpine Ajax maybe? https://alpine-ajax.js.org/ https://alpine-ajax.js.org/
- deisteve 2y agothere was actually another library but alpine ajax is close tooo
- indigodaddy 2y agoCool I’d be interested as well then
- moritzwarhier 2y agoI'm not an active user of both (but used Alpine in the past), but this is not what you are seeking, or is it? https://v1.htmx.org/extensions/alpine-morph/ https://v1.htmx.org/extensions/alpine-morph/
- deisteve 2y agoi found it https://data-star.dev/ https://data-star.dev/ never used it curious to know if anybody have https://news.ycombinator.com/item?id=41482052 https://news.ycombinator.com/item?id=41482052
- moritzwarhier 2y agoAh OK, thanks for your reply. Wasn't sure what you meant by "bringing together". I assumed you were meaning to connect both, not replace. Fair though. I'm wondering whether the next big thing in this space is going to be more BE-driven and include streaming larger fragments or some other sort of improvement. Anything that does more than Alpine and htmx so far seems to struggle bringing innovation. It was fun once working on a Laravel project where it was somdtimes confusing for a new collaborator to make sense of which "x-attributes" were Alpine, so client-JS-related and which ones were part of server-side Blade templates, so dynamic but not "reactive". This naming collision was preventable and misleading, but it somehow still "felt right".
- aitchnyu 2y agoI disable htmx.config.allowScriptTags, which is true by default and "determines if htmx will process script tags found in new content". Also htmx.config.selfRequestsOnly which prevents cross-origin requests. https://v2-0v2-0.htmx.org/reference/#config https://v2-0v2-0.htmx.org/reference/#config