buildCsp
Builds the header value.
Builds the header value. The result is validated: directive names, and sources that could
smuggle another directive or policy (;, ,, whitespace, control characters), are rejected.
Import#
ts
import { buildCsp } from "@shadow-js/dusk/server";
Signature#
ts
function buildCsp(options: CspOptions, nonce: string | undefined): string
Parameters#
| Name | Description |
|---|---|
options |
The policy. |
nonce |
The request's nonce; required when a source uses {nonce}. |
Returns#
The header value.
Throws#
- TypeError for an invalid directive or source, or when
{nonce}is used without a nonce. - RangeError when the result is longer than 8192 characters.
Examples#
ts
buildCsp({}, "abc"); // "default-src 'self'; script-src 'self' 'nonce-abc'; ..."