So everybody and their mother says to use
wp_localize_script to pass PHP variables client side. Even though the function is not actually made for this purpose, everybody does it. Kind of like Q-Tips: not made for cleaning ears, everybody does it anyways.
With technology moving forward and people generally against things inline I don't want to have inline script for all those little variables. I'm especially doomed because I want to use the Content Security Policy HTTP header. There simply is no cool way to have inline JS (even worse: dynamic inline JS, you can't sha256 that) and have a CSP.
What other ways could I use to pass a variable set in PHP client side without creating nasty inline
Maybe a WebService could push variables clientside? A PHP generated
php_variables.js file with a dynamic hash if a variable has changed so browser caches refresh? Other ideas?