5
[Help] Designing a dynamic component service with HTMX (programming.dev)
submitted 22 hours ago by to c/webdev@programming.dev
6 comments fedilink hide all child comments
 

cross-posted from: https://programming.dev/post/54211132

Hi people. I'm creating a system using HTMX
It's a server using clj-kit, which renders "components" using hiccup and HTMX based on the requests.
A component generator basically. But it also has some JSON APIs which return pure data.

The details don't matter. It just exposes REST APIs, user calls REST API with their own custom params and get their custom component.

The goal is so this can be used for progressive rewrite and enhancement of legacy systems, and the components to be usable in multiple systems, reducing work.
In order for the user of the system to be able to use these components, they should also add HTMX to their client, and call the service. for example

<div hx-get="https://component.service/componentx?data-url=https%3A%2F%2Fdata.source%2Fdata" hx-trigger="load">

This is the architecture I thought of. Is this ok? This HTMX article on security says it's not ok to call HTMX with external sources. So what is the best way you suggest to create such system?

I'm halfway through it already, but I would like to hear what others have to say and your suggestions. Maybe HTMX isn't the right choice at all? I felt like it is.

Thank you.

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 17 hours ago (1 child)

This HTMX article on security says it’s not ok to call HTMX with external sources.

Where does it say that? It says “Only call routes you control”. As I understood you, you do control those routes.

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 1 point 15 hours ago

    Hypermedia APIs (i.e. HTML) are specific to the layout of your application, so there is almost never any reason you’d want to insert someone else’s HTML into your page. All you have to do is make sure you only call your own routes (htmx 2 will actually disable calling other domains by default).

    Although I do control the routes, its seems like it's not common. One way is a reverse proxy so the component server is forwarded on /components path on the client. So the client can still call relative routs.

  • permalink
  • fedilink
  • source
  • parent