vite-plugin-csp-dev 1.0.1 → 1.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +25 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
A Vite plugin to add Content Security Policy (CSP) headers to your application in serve mode.
|
|
4
4
|
|
|
5
|
-
In order to set CSP headers in production builds, you must configure your web server accordingly
|
|
5
|
+
In order to set CSP headers in production builds, you must configure your web server accordingly. This plugin transforms build output in order to facilitate that.
|
|
6
6
|
|
|
7
7
|
## Usage
|
|
8
8
|
|
|
@@ -39,3 +39,27 @@ export default {
|
|
|
39
39
|
],
|
|
40
40
|
};
|
|
41
41
|
```
|
|
42
|
+
|
|
43
|
+
In server configuration, set the CSP header similarly to vite-plugin-csp-dev. `NONCE_PLACEHOLDER` should be replaced with a generated nonce value for each request. For example, in nginx:
|
|
44
|
+
|
|
45
|
+
```
|
|
46
|
+
map $request_id $nonce {
|
|
47
|
+
~. $request_id;
|
|
48
|
+
}
|
|
49
|
+
|
|
50
|
+
server {
|
|
51
|
+
sub_filter_once off;
|
|
52
|
+
sub_filter_types *;
|
|
53
|
+
sub_filter NONCE_PLACEHOLDER $nonce;
|
|
54
|
+
|
|
55
|
+
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$nonce'; style-src 'self' 'nonce-$nonce'; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; connect-src: 'self'; frame-ancestors 'none'; worker-src 'self'; upgrade-insecure-requests;";
|
|
56
|
+
add_header X-XSS-Protection "1; mode=block";
|
|
57
|
+
add_header X-Frame-Options "DENY";
|
|
58
|
+
add_header X-Content-Type-Options "nosniff";
|
|
59
|
+
add_header Referrer-Policy "strict-origin-when-cross-origin";
|
|
60
|
+
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()";
|
|
61
|
+
add_header Cache-Control "no-store, max-age=0";
|
|
62
|
+
|
|
63
|
+
# Other server configurations...
|
|
64
|
+
}
|
|
65
|
+
```
|
package/package.json
CHANGED