Hacker News Reader

You can disable all use of eval with htmx. The tradeoff is one has to write a bit more JavaScript.

I have thoughts about a fully compliant CSP middleware, problem is it's per language so I'd probably only make for Go (maybe PHP & TS)

Hashes or nonces?

Hashed script content

Thank you for doing this. Is it possible to follow the work somewhere?

Not right now. CSP in a Datastar context is mostly a red herring. If an enterprise wants it to check a box then please reach out.

I don't represent an enterprise; just a dev. It would make it easier to sell the idea of Datastar to clients if it was compatible with strict CSP.