htmx Security

Use this skill before shipping htmx features that render user content, accept rich HTML, add third-party scripts, change Content Security Policy, or expose new mutation endpoints.

Threat Model

htmx keeps rendering on the server, but unsafe HTML is still unsafe HTML. A fragment swap can insert scripts, event handlers, dangerous URLs, or htmx attributes that cause requests. Treat every fragment as executable browser surface unless it is escaped or sanitized.

Baseline Rules

• Escape user-supplied text by default.
• Sanitize rich HTML on the server with a strict allowlist.
• Strip or block hx-*, data-hx-*, hx-on, inline event handlers, script, dangerous URLs, and style features that the product does not explicitly allow.
• Keep auth, authorization, and validation on the server.
• Use CSRF protection for same-origin mutations.
• Do not put secrets, privileged object IDs, or authorization decisions in HTML attributes.
• Keep htmx requests same-origin unless CORS, CSRF, cookies, and credentials are deliberately designed.

User Content