Keep sensitive content out of history snapshots

HTMX 2 can store DOM snapshots in localStorage so Back and Forward restoration feels immediate. On a shared computer, that cache may outlive the visible page.

Prevent the current page state from entering that cache with:

<main hx-history="false">
  <!-- account or medical information -->
</main>

The attribute can appear anywhere in the current document or an inserted fragment. It embargoes the whole page snapshot, not only its own subtree. History navigation still works, but HTMX requests the URL from the server when it must restore that state.

The server must authenticate and authorize the restoration request exactly like direct navigation. HX-History-Restore-Request is rendering context, not permission.

Do not render API keys, raw tokens, unnecessary personal data, or secrets into HTML in the first place. hx-history="false" protects against one browser cache; it does not remove content from the DOM, screenshots, extensions, logs, or network responses.

Test by navigating away, inspecting local storage, and using Back. Confirm the sensitive markup was not snapshotted and the server still denies restoration after the session expires.