CspOptions

Options of the Content-Security-Policy builder.

Import#

import type { CspOptions } from "@shadow-js/dusk/server";

Signature#

interface CspOptions {
  /**
   * Directives to add or replace, name to sources. `true` writes a bare directive such as
   * `upgrade-insecure-requests`; an empty array removes a default directive. The source
   * `"{nonce}"` becomes `'nonce-<value>'` for the request.
   */
  readonly directives?: Readonly<Record<string, readonly string[] | true>>;
  /** Start from the strict defaults (see {@link defaultCspDirectives}). Default `true`. */
  readonly useDefaults?: boolean;
  /** Send `Content-Security-Policy-Report-Only` instead. Default `false`. */
  readonly reportOnly?: boolean;
  /** Adds `report-uri`. */
  readonly reportUri?: string;
}

Members#

Name	Type	Description
`directives?`	`readonly directives?: Readonly<Record<string, readonly string[] \| true>>`	Directives to add or replace, name to sources. `true` writes a bare directive such as `upgrade-insecure-requests`; an empty array removes a default directive. The source `"{nonce}"` becomes `'nonce-<value>'` for the request.
`useDefaults?`	`readonly useDefaults?: boolean`	Start from the strict defaults (see defaultCspDirectives). Default `true`.
`reportOnly?`	`readonly reportOnly?: boolean`	Send `Content-Security-Policy-Report-Only` instead. Default `false`.
`reportUri?`	`readonly reportUri?: string`	Adds `report-uri`.

Examples#

const csp: CspOptions = { directives: { "img-src": ["'self'", "https://images.example.com"] } };