hx-nonce + Trusted Types CSP test

1. Basic hx-get swap

Tests that nonced elements can make requests and swap content.

2. JS eval paths (all require safeEval under no-eval CSP)

Each button exercises a different htmx JS eval entry point. Check console for output.

hx-on:click — inline event handler

hx-trigger filter — click[expression] guard

hx-vals js: — JS object expression for request body

hx-headers js: — JS object expression for request headers

hx-confirm js: — async confirm via JS expression

hx-get js: — JS expression executed instead of HTTP request (side-effect only, no swap)

3. Script tag execution in swapped responses

Tests whether scripts in partial responses execute based on their nonce.

With nonce — script carries the response nonce, rewritten to page nonce by hx-nonce. Should execute under all modes.

Without nonce — script has no nonce. Should execute in permissive, blocked by CSP in all nonce modes.

4. Blocked elements (should never fire a request)

Both buttons should be stripped by hx-nonce and fire htmx:security:strip.