Skip to main content

Module csp

ssg

Module csp 

Source
Expand description

Content Security Policy hardening plugin.

Extracts inline <style> and <script> blocks into external files with Subresource Integrity (SRI) hashes, eliminating the need for 'unsafe-inline' in the Content-Security-Policy header.

Structs§

CspPlugin
Plugin that extracts inline styles/scripts to external files with SRI.
PageCspHashes
CSP source hashes for the inline blocks remaining on a single page (spec B4, plan §3 item 2.4).

Constants§

DEFAULT_CSP_POLICY
Canonical Content-Security-Policy string emitted by the CSP plugin.
DEFAULT_CSP_POLICY_TEMPLATE
Content-Security-Policy template with {script_hashes} and {style_hashes} slots (spec B4, v0.0.47 plan §3 item 2.4).

Functions§

computed_policy
Returns the canonical Content-Security-Policy string that the CSP plugin’s inline-extraction posture is designed to enforce.
inject_csp_meta
Inserts a <meta http-equiv="Content-Security-Policy" content="..."> tag immediately after the <head> opening tag.
page_inline_hashes
Computes the CSP source hashes for every inline block on a page.
page_policy
Computes the per-page Content-Security-Policy for a built HTML page, or None when the page has no inline blocks and the global computed_policy applies unchanged (spec B4).
policy_for_meta
Strips the directives a <meta>-delivered policy cannot carry.
render_policy_template
Renders a CSP policy template, expanding the {script_hashes} and {style_hashes} slots into space-prefixed 'sha256-…' sources.