csp

Generate CSP meta and nonces.

Inject file specific content security policy meta elements.

For each HTML file inspect the plugin rules and inject a meta element for each matched rule. When the styles or scripts options are used it will also generate content security policies using the nonce algorithm and add the nonce values as attributes to the inline elements.

Requires that the parse-html and parse-csp plugins have been enabled for the parse phase as it operates on the HTML and CSP abstract syntax trees.

Enable this plugin for the transform phase.

new ContentSecurityPolicy(context, options)

Create a ContentSecurityPolicy plugin.

Use this plugin during the transform phase, you should enable the parse-csp and parse-html plugins for the parse phase.

This plugin uses a default content security policy parsed from csp.txt,

When the watch option is set this plugin will automatically include a connect-src policy with the ws://localhost:* and http://localhost:* values so that browsersync will work as expected.

A rule consists of a test regular expression pattern and the policy to merge with the parsed content security policy abstract syntax tree.

{
  rules: [
    {
      test: /news\//,
      file: 'news-csp.txt',
      policy: {
        'default-src': ['self'],
        'frame-src': ['none']
      }
    }
  ]
}

Use the file rule field when you want to use a default policy from an alternative content security policy file.

If no test pattern is specified for a rule it will apply to all files this plugin matches.

Use the styles and scripts options to generate content security policies for inline elements using the nonce algorithm. This will add nonce attributes to the inline elements and update the content security policy to include the generated nonce values.

The generated nonce value is a base64 encoded string of 32 random bytes generated by crypto.randomBytes(), you can use the bytes option to change the number of bytes used.

ContentSecurityPolicy.prototype.before(context, options)

Configure the list of matched files.

ContentSecurityPolicy.prototype.sources(file, context, options)

Find the first matching rule for a file.

ContentSecurityPolicy.prototype.after(context, options)

Rewrite file content.