Proposal: drop htmx #14750

New Issue

GiteaMirror · 2025-11-02T11:21:58-06:00

GiteaMirror commented

2025-11-02 11:21:58 -06:00

Originally created by @wxiaoguang on GitHub (Jul 12, 2025).

htmx is fun and handy for a small project, but it doesn't work well for a large one.

I can see some fundamental problems due to its fragile design:

It supports automatically sending POST methods, but it doesn't support CSP nonce.
- It makes the website under the XSS-like risk, attacker can inject and execute tags with hx-xxx attributes even if the CSP nonce is used
It has unclear behaviors, e.g.: when reading a hx-xxx on an element, we are not able to know what happens in its parents
- https://github.com/bigskysoftware/htmx/issues/2515
Its loading & initialization behavior is quite strange, and unlikely to be fixed
- https://github.com/bigskysoftware/htmx/pull/3365
Its "hx script" support is fragile and unable to lint
Developers should always remember to call htmx.process when modifying innerHTML/outerHTML, but it is frequently forgotten
- #33851
- I added the htmx.process in #35010 (a646b328b8)

And its size is similar to jQuery (not trivial), in Gitea's code base, we only use very a few of htmx's features, which can be implement by ourselves with a better design.

Originally created by @wxiaoguang on GitHub (Jul 12, 2025). htmx is fun and handy for a small project, but it doesn't work well for a large one. I can see some fundamental problems due to its fragile design: 1. It supports automatically sending POST methods, but it doesn't support CSP nonce. * It makes the website under the XSS-like risk, attacker can inject and execute tags with `hx-xxx` attributes even if the CSP nonce is used 2. It has unclear behaviors, e.g.: when reading a `hx-xxx` on an element, we are not able to know what happens in its parents * `https://github.com/bigskysoftware/htmx/issues/2515` 3. Its loading & initialization behavior is quite strange, and unlikely to be fixed * `https://github.com/bigskysoftware/htmx/pull/3365` 4. Its "hx script" support is fragile and unable to lint 5. Developers should always remember to call `htmx.process` when modifying `innerHTML/outerHTML`, but it is frequently forgotten * #33851 * I added the `htmx.process` in #35010 (https://github.com/go-gitea/gitea/commit/a646b328b8ca79fc052c162fdcf0929a4d49e060) And its size is similar to jQuery (not trivial), in Gitea's code base, we only use very a few of htmx's features, which can be implement by ourselves with a better design.

GiteaMirror added the type/proposal label 2025-11-02 11:21:58 -06:00

GiteaMirror commented

2025-11-02 11:21:59 -06:00

@stuzer05 commented on GitHub (Jul 12, 2025):

Is it possible te make entire UI in vue as single app?

@stuzer05 commented on GitHub (Jul 12, 2025): Is it possible te make entire UI in vue as single app?

GiteaMirror commented

2025-11-02 11:21:59 -06:00

@lunny commented on GitHub (Jul 12, 2025):

Is it possible te make entire UI in vue as single app?

I think it’s reasonable to use SPA for settings and admin pages, but not for publicly accessible pages, for the following key reasons:

SPA increases initial loading time, which can negatively affect user experience.
It’s not SEO-friendly, making public content harder to index and discover.
It requires significant effort, but the benefits are unclear.

Therefore, I suggest we rewrite the current HTMX-based components using Vue - but only for these pages, not the entire site.

@lunny commented on GitHub (Jul 12, 2025): > Is it possible te make entire UI in vue as single app? I think it’s reasonable to use SPA for settings and admin pages, but not for publicly accessible pages, for the following key reasons: - SPA increases initial loading time, which can negatively affect user experience. - It’s not SEO-friendly, making public content harder to index and discover. - It requires significant effort, but the benefits are unclear. Therefore, I suggest we rewrite the current HTMX-based components using Vue - but only for these pages, not the entire site.

GiteaMirror commented

2025-11-02 11:22:00 -06:00

@wxiaoguang commented on GitHub (Jul 15, 2025):

cc @silverwind @yardenshoham

@wxiaoguang commented on GitHub (Jul 15, 2025): cc @silverwind @yardenshoham

GiteaMirror commented

2025-11-02 11:22:00 -06:00

@yardenshoham commented on GitHub (Jul 15, 2025):

I think it adds enough value to the end-user to be worth the maintenance burden. I also recognize there is a maintenance burden, and it looks like I am the only one comfortable with it. For that reason, I will not block an htmx removal effort.

@yardenshoham commented on GitHub (Jul 15, 2025): I think it adds enough value to the end-user to be worth the maintenance burden. I also recognize there is a maintenance burden, and it looks like I am the only one comfortable with it. For that reason, I will not block an `htmx` removal effort.

GiteaMirror commented

2025-11-02 11:22:00 -06:00

@wxiaoguang commented on GitHub (Jul 15, 2025):

Yep, it does add enough value, and I think "which can be implement by ourselves with a better design", then no maintenance burden.

@wxiaoguang commented on GitHub (Jul 15, 2025): Yep, it does add enough value, and I think "which can be implement by ourselves with a better design", then no maintenance burden.

GiteaMirror commented

2025-11-02 11:22:00 -06:00

@silverwind commented on GitHub (Jul 15, 2025):

I never liked it. It's designed for the use case of js-less apps, but we have js and we can do better.

@silverwind commented on GitHub (Jul 15, 2025): I never liked it. It's designed for the use case of js-less apps, but we have js and we can do better.

GiteaMirror commented

2025-11-02 11:22:01 -06:00

@ptman commented on GitHub (Oct 27, 2025):

htmx does support CSP nonce, check out e.g. inlineScriptNonce. But I'm not going to maintain htmx in gitea, so maintainers will decide what they want to maintain.

@ptman commented on GitHub (Oct 27, 2025): htmx does support CSP nonce, check out e.g. inlineScriptNonce. But I'm not going to maintain htmx in gitea, so maintainers will decide what they want to maintain.

GiteaMirror commented

2025-11-02 11:22:01 -06:00

@wxiaoguang commented on GitHub (Oct 27, 2025):

htmx does support CSP nonce, check out e.g. inlineScriptNonce. But I'm not going to maintain htmx in gitea, so maintainers will decide what they want to maintain.

Content-Security-Policy nonce: it is designed to prevent the untrusted scripts from executing
htmx's inlineScriptNonce: it only adds "nonce" to inline script tags
htmx's "hx script": it executes the untrusted scripts injected by attackers even if Content-Security-Policy nonce doesn't allow

Overall, htmx's design doesn't look right.

@wxiaoguang commented on GitHub (Oct 27, 2025): > htmx does support CSP nonce, check out e.g. inlineScriptNonce. But I'm not going to maintain htmx in gitea, so maintainers will decide what they want to maintain. * Content-Security-Policy nonce: it is designed to prevent the untrusted scripts from executing * htmx's inlineScriptNonce: it only adds "nonce" to inline script tags * htmx's "hx script": it executes the untrusted scripts injected by attackers even if Content-Security-Policy nonce doesn't allow Overall, htmx's design doesn't look right.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#14750