Post #1001705

Excellent advice here for all web applications, and #htmx ones in particular: - Only call routes you control - Always use an auto-escaping template engine - Only serve user-generated content inside HTML tags - If you have authentication cookies, set them with Secure, HttpOnly, and SameSite=Lax https://htmx.org/essays/web-security-basics-with-htmx/