CSP not working with minification integrations

[jurajkapsz]

Astro Info

Astro                    v5.13.4
Node                     v24.6.0
System                   Linux (x64)
Package Manager          pnpm
Output                   static
Adapter                  @astrojs/node
Integrations             mysong-compress

If this issue only occurs in one browser, which browser is a problem?

No response

Describe the Bug

When using Astro CSP alongside with compress integrations eg mysong-compress or @playform/compress, inlined styles and scripts fail to apply.

Refused to apply inline style because it violates the following Content Security Policy directive...

Probably because CSP hash generation runs before minification?

What's the expected result?

Be able to use compressions along with Astro CSP.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-n8kutkgp?file=astro.config.mjs

Participation

• I am willing to submit a pull request for this issue.

[ematipico]

That's expected, that's how CSP works. If you add the hashes of scripts and styles, the directive unsafe-inline doesn't work. I presume those integrations are adding the unsafe-inline directive in some pages, and that's why they trigger the problem.

The CSP feature is an experimental feature. I don't know if you're the maintainer of those integrations, but there two suggestions:

• you could reach out to the maintainers of the integrations, and and get them involved in the RFC, with how integrations can add hashes during the build
• you get involved with the RFC, and see we can find a solution to your problem

Regardless, we can't count this as a bug, because we don't know if it's a bug, and if it is, how the solution will look like. Regardless, it seems that the integrations don't play well with CSP, and they should be aware about them.

Here's the link to the RFC withastro/roadmap#1168

[jurajkapsz]

Thanks, I'll follow up on this, I am not a maintainer. I've used one or the other compression till now, and I've tried out the CSP feature. At minimum, I let the maintainers know.

At some point, I wanted to create my own maybe more lightweight compress integration and basically, the provided compressions should occur within astro:build:done hook. I was thinking that the CSP hashes are by that time already generated and maybe it would be possible to generate them as the last thing. But I have to look at the specs as you mentioned. Also, I was thinking to provide the CSP policies to my static server configuration (eg nginx) to have them on server level etc. I will look more into the provided docs.