feat(csp): allow additional directives

[ematipico]

Changes

This PR adds support for additional directives inside the <meta> tag. As for now, Astro is only responsible for customising the script-src and style-src directives, however other directives aren't provided.

A user can always provide additional directives via the Response header; however, to avoid the use of multiple values (Response headers and meta data), and incurr in situations where the browser picks a different directive, Astro now allows user to add additional directives, which will be eventually rendered in the meta tag.

There's a very tiny level of validation, where if directives start with script-src or style-src, we throw an error.

We will provide additional configurations in case users need to customise script-src and style-src directives.

To note that I updated the RFC to use the term "directive". Initially I chose the term "policy". Directive is the right term.

https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md#configuration-apis

Note

The API is different from the RFC, I changed it now to make it strictly typed. I will update the RFC once we merge this PR

Testing

Added new tests

Docs

[changeset-bot]

⚠️ No Changeset found

Latest commit: a191009

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[ascorbic]

Can you describe the API, where it differs from the RFC?

[florian-lefebvre]

Code LGTM, I'm curious to see the implementation of insertDirective 👀

[ematipico]

Yeah, sorry, here's the API change

Before:

{
	csp: {
		directives: ["img-src 'self' 'https://cdn.example.com'"]
	}
}

After:

{
	csp: {
		directives: [{
			type: "img-src" // strongly typed,
			content: "'sef' 'https://cdn.example.com'"
		}]
	}
}

Since Astro needs to manage script-src, and style-src, with this new API change users won't be able to tinker with those directives. Also, you get some auto complete too :)

[ascorbic]

Ah, got it. It's a shame that stuff like this doesn't work:

type NotScriptSrc = Exclude<string, `script-src ${string}`>

[ascorbic]

Oh, actually you could do this if you want to keep the old API:

type CspDirective = `${AllowedDirectives} ${string}`

[ematipico]

RFC updated: withastro/roadmap@cc6d3bf (#1168)