Skip to content

feat(csp): fix CSP header, inject astro island script/style #13687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Parent: feat: experimental CSP
merged 4 commits into from
Apr 28, 2025
Merged

feat(csp): fix CSP header, inject astro island script/style #13687

merged 4 commits into from
Apr 28, 2025

Conversation

@ematipico
Copy link
Member

Changes

  • Fixes the content that should be passed to the CSP meta tag. Its content must be the same as the CSP response header
  • Reworked the prebuilt hashes to contain their name so that we can distinguish styles from scripts
  • If Astro detected some renderers, we assume that the user will use some client components, so we add the hashes of Astro Island (style and script), Astro client directives (all of them for now, because we don't know yet which ones are used when rendering the head)

Testing

Added a new test with React, and updated the existing assertions to check for Astro Island script and style

Docs

N/A

@changeset-bot
Copy link

changeset-bot bot commented Apr 25, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: 342014d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions bot added pkg: astro Related to the core `astro` package (scope) docs pr labels Apr 25, 2025
@ematipico ematipico merged commit d2482b3 into feat/csp Apr 28, 2025
15 checks passed
@ematipico ematipico deleted the feat/csp-astro-island branch April 28, 2025 12:06
ematipico added a commit that referenced this pull request May 1, 2025
@ematipico
feat(csp): fix CSP header, inject astro island script/style (#13687)
ae66730
ematipico added a commit that referenced this pull request May 1, 2025
@ematipico @florian-lefebvre @ascorbic
feat(csp): support view transitions (#13738)
5c0f24d 
Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
fix CSP header, inject astro island script/style (#13687)
ematipico added a commit that referenced this pull request May 14, 2025
@ematipico
feat(csp): fix CSP header, inject astro island script/style (#13687)
b3c65fa
ematipico added a commit that referenced this pull request May 14, 2025
@ematipico @florian-lefebvre @ascorbic
feat(csp): support view transitions (#13738)
92bc2ae 
Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
fix CSP header, inject astro island script/style (#13687)
ematipico added a commit that referenced this pull request May 22, 2025
@ematipico
feat(csp): fix CSP header, inject astro island script/style (#13687)
77bceec
ematipico added a commit that referenced this pull request May 22, 2025
@ematipico @florian-lefebvre @ascorbic
feat(csp): support view transitions (#13738)
e63013b 
Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
fix CSP header, inject astro island script/style (#13687)
ascorbic added a commit that referenced this pull request Jun 4, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot
feat: experimental CSP (#13802)
0eafe14 
* chore: build hashes of scripts (#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (#13675)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): fix CSP header, inject astro island script/style (#13687)

* feat(csp): track client scripts and CSS (#13725)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): support view transitions (#13738)

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
fix CSP header, inject astro island script/style (#13687)

* feat(csp): server islands (#13775)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): customise algorithm (#13803)

Co-authored-by: Florian Lefebvre <[email protected]>

* chore: build hashes of scripts (#13590) (#13805)

Co-authored-by: Florian Lefebvre <[email protected]>

* feat(csp): allow additional directives (#13810)

Co-authored-by: ascorbic <[email protected]>
Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): resources for script and styles directives (#13812)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): runtime APIs (#13824)

Co-authored-by: Matt Kane <[email protected]>

* feat(csp): add script-dynamic keyword support (#13834)

* update lockfile

* chore: docs and changeset (#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <[email protected]>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

---------

Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>
openscript pushed a commit to openscript/astro that referenced this pull request Sep 12, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot @openscript
feat: experimental CSP (withastro#13802)
1d9a567 
* chore: build hashes of scripts (withastro#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (withastro#13675)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): track client scripts and CSS (withastro#13725)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): support view transitions (withastro#13738)

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): server islands (withastro#13775)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): customise algorithm (withastro#13803)

Co-authored-by: Florian Lefebvre <[email protected]>

* chore: build hashes of scripts (withastro#13590) (withastro#13805)

Co-authored-by: Florian Lefebvre <[email protected]>

* feat(csp): allow additional directives (withastro#13810)

Co-authored-by: ascorbic <[email protected]>
Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): resources for script and styles directives (withastro#13812)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): runtime APIs (withastro#13824)

Co-authored-by: Matt Kane <[email protected]>

* feat(csp): add script-dynamic keyword support (withastro#13834)

* update lockfile

* chore: docs and changeset (withastro#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <[email protected]>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

---------

Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@florian-lefebvre florian-lefebvre florian-lefebvre approved these changes

Assignees

No one assigned

Labels

docs pr pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ematipico @florian-lefebvre