What security risks are specific to htmx, and how do you mitigate them?

Summary

Any XSS becomes more dangerous because injected hx- attributes are activated by htmx (an injected hx-delete with hx-trigger="load" would run). Mitigate by escaping all output, wrapping user HTML in hx-disable, keeping selfRequestsOnly on, and considering allowScriptTags: false and allowEval: false with a strict CSP.

Longer Answer

Server rendering means the template engine is your XSS defence: never mark user content as safe. hx-disable stops htmx from processing any attributes inside an element. CSRF still applies because htmx requests carry cookies. Set historyCacheSize to 0 for sensitive pages so snapshots aren't kept in sessionStorage.

Key Points

• Escape output; injected hx- attributes run.
• hx-disable around user HTML.
• selfRequestsOnly, allowEval, allowScriptTags.
• CSRF and history cache.

Deep dive: htmx: Build Interactive Web Apps with HTML: Securing an htmx App

What interviewers look for

Escaping first, then htmx-specific controls, plus CSRF.