ContentSecurityPolicy object

Use ContentSecurityPolicy to configure the Content-Security-Policy header.

Syntax

interface ContentSecurityPolicy {
    useDefaults: boolean;
    reportOnly: boolean;
    resourceHashing: boolean;
    directives: { [key: string]: string[] };
}

Options

Option	Description	Default Value
`useDefaults`	When `true`, it merges the default header directives with any custom directives you pass in via the `directives` object.	`false`
`reportOnly`	Set this option to one or more policy directives. For example: `default-src https:; report-to /csp-violation-report-endpoint/`	`'content-security-policy'`
`resourceHashing`	When `true`, inline scripts are hashed for the header.	`true`
`directives`	In this section, you can configure directives for the `Content-Security-Policy` header.

Directives

You can customize these directives for a Content-Security-Policy header. Set values for them in the directives section of a ContentSecurityPolicy object.

Example

For example, this ContentSecurityPolicy object tells the Content-Security-Policy header to use the media-src 'self' directive in addition to to the default directives.

"contentSecurityPolicy":
    {
        "useDefault": true,
        "resourceHashing": false,
        "directives": "media-src 'self';"
    }

This ContentSecurityPolicy has useDefaults: false, which removes all the default directives and values. It only defines a value for the media-src directive, so all other directives accept content from any source.

"contentSecurityPolicy":
    {
        "useDefault": false,
        "resourceHashing": false,
        "directives": "media-src 'self';"
    }

See Also

Guide: @lwrjs/security