Developers Do NOT Understand the POWER Of HTMX

SUBSCRIBE OR NO MARGARITAS
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝

[JT-mrdb]

HTMX is so absurdly simple that it threatens developers who are used to complex technical masturbation.

It's pretty remarkable how far you can get with HTMX without needing a heavy UI framework.

[pythonantole]

One major problem with the web dev industry is that we have successfully been brainwashed to believe that if something is simple then its wrong, has a catch, is not secure, not safe etc etc. We now believe that a good solution must be complicated. We have developers building websites or apps that will never have more than 10, 000 users saying they can't use technology X because technology X can't scale. We have become idiots. I did a Laravel + Livewire site to replace one that was aging and full of bugs from one of those frameworks that gets a new release every time it rains and "senior developers" kept asking how i pulled it off without React. It's like you can't build anything unless you use some hippy shiny, complicated and over engineered tool.

[roccociccone]

As a guy who hates Js and doesn’t like the whole frontend bs, HTMX is a god send. I can finally make highly reactive apps without or very little JS. I love it.

[amadeusm.]

I strongly agree, why has everything to be so complicated today. The little Timmies don't even know about the olden ways. XHR, SOAP, etc. and NEVER trust the CLIENT.

[picatchumm]

Good morning,
I agree, what is missing in my opinion are opensource examples of projects a little more complex than POCs, to see the full potential of HTMX, and for it to really take off.

[damien]

Well yes you must validate and sanitize user inputs, but that won’t guarantee your site is XSS proof. Not to mention that sanitizing for database storage is not the same as sanitizing for html output. The potential attack vector for XSS attacks is quite large actually.

[licokr]

They may get a wrong idea coming from updating the whole html of htmx. The point is that the frontend is cooperation with a trustful team member, not with a stranger. If you're working with go, templ and they're one proj. Sanitization is supposed to be done from the server side. Nowadays, there are lots of double works by dividing two sides, frontend and backend. It might be needed depending on some factors, teams, people or whatever. I guess there might be some projects sanitization is done in front side and the api responses then the full data, maybe that's why they think that, you know they only see onside..or they're just confused the concept. I could imagine one situation, the backend is broke down by some hacks and the code was changed and responded the vulnerable code to the clients. Somehow, the frontend code is saved, only the backend is broke down. Let's say the two parts were dividing from different servers. Hmm.... then ja maybe... If you‘re writing the whole code in a project like golang templ stack, it would not be consideration though. Let's say there are pure htmx client project and go lang server... somehow the server is broken and some body changed the code to hijacking clients' data without them knowing. So.. vulnerable html code is loaded to client's side and they're hacked and no body knows... and could say it's XSS no.. it's wrong from the first place. There are so many considerations cause it's already broke down it's not about htmx, it's the problem regarding security. I made myself complicated lol. Thanks for the video. I subscribed 👍 I was thinking of using htmx for the next project and that you've done your service with htmx gives me a lot of trust to htmx. Thanks! I will go look for a Mcdonald's job.

[vitiok]

HTMX is literally just HTML forms at its core. If you are a web developer and you don't know how to sanitize data coming from HTML forms you should be fired immediately...

[Grahamaan]

HTMX is just another framework you have to learn that is more limited than JavaScript. I'm personally just fine with lightly using JavaScript in my projects and not worrying about 3rd party imports

[Raphael-jorp]

"And if you don't get it, it's time to go back to the Mac Donald's job" 🤣

[RA-xxmz]

I’ve been using HTMX/Templ/Golang to construct an MVP for an ad tech platform.

It’s a very clean way to make things.

It’s nice not to have to write a whole state management cycle. If I want to update something, I can update it and just target the dom element I want to swap with the new data.

You forgot the hx-trigger on the button btw.

:p

[doichev-kostia]

But we’re doing the same thing right now. The API sends you JSON, you map the data to JS objects with a fancy name JSX, and then in runtime those JS objects are inserted in DOM as HTML elements


Same thing, but with quite some steps :)

You can send CSV files from the API, if your client can handle it, the question is why?

[manfrombritain]

"why are you going to over-complicate it?"

cos of the people who pay for the product and the people who pay the salaries 😂

[anticaleksandar]

Hi Anthony, youre not 100% right about xss, its not only the Backend that need so be safe. Can we make a deal, i will teach you xss techniques and you can teach me Golang interfaces. 🤗 best regards, Aleks

[axMfqTI]

Htmx is not that hard to understand. It's like html frames back in the days.. have the nav in one frame and have it load the content in an other frame by doing a get request.

[pythic-nl]

.. it's time to get back to the MC Donalds job ... hahahaha ... lekker man ..

[Qixiano]

What about CSRF protection? Could you share an example implementing this protection?

Thanks

[jugurtha]

what if someone’s purpose to attack the client not the server?

[jibreelkeddo]

I love HTMX too, but you are being a little too dismissive of the XSS risk. You can deploy the safest possible backend API sanitizer today in 2024, retire tomorrow, and then have 20 XSS exploits discovered about your backend of choice in the next year leading to all of your customers having their payment information stolen and ruining your business. I hope we can start seeing more advanced client-side security validation features for future versions HTMX.

[Omniwoof]

McDonald's said they won't take me back. :(