pub const DEFAULT_CSP_POLICY: &str = "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' https: data:; font-src 'self' https:; connect-src 'self'; frame-ancestors 'none'";Expand description
Canonical Content-Security-Policy string emitted by the CSP plugin.
Returned by computed_policy and consumed by downstream emitters
(e.g. the edge_headers postprocess plugin) that need to forward
the same policy as an HTTP header instead of a <meta> tag.
The string is intentionally 'unsafe-inline'-free; this matches the
post-extraction posture enforced by CspPlugin::transform_html
and inject_csp_meta (which strip 'unsafe-inline' from any
preexisting <meta> policy on the way through).