vite-plugin-csp-dev 1.0.4 → 1.0.6

package/README.md

@@ -1,8 +1,6 @@
 # vite-plugin-csp-dev
 
-A Vite plugin to add Content Security Policy (CSP) headers to your application in serve mode.
-
-In order to set CSP headers in production builds, you must configure your web server accordingly. This plugin transforms build output in order to facilitate that.
+Vite plugin for Content Security Policy with nonce support. Adds CSP headers in development and injects nonce placeholders in production builds for server-side replacement.
 
 ## Usage
 
@@ -15,9 +13,9 @@ export default {
   plugins: [
     secureHeaders({
       reportOnly: false, // default: false - Report CSP violations instead of blocking them.
-      processI18n: true, // default: true - Process i18n.
+      processI18n: false, // default: false - Process i18n.
       defaultSrc: "'self'", // default: "'self'" - Value for default-src directive in CSP.
-      noncePlaceholder: 'NONCE_PLACEHOLDER', // default: 'NONCE_PLACEHOLDER' - Placeholder for nonce in HTML.
+      noncePlaceholder: 'NONCE_PLACEHOLDER', // default: 'NONCE_PLACEHOLDER' - Placeholder replaced by server.
       xssProtection: '1; mode=block', // default: '1; mode=block' - Value for X-XSS-Protection header.
       frameOptions: 'DENY', // default: 'DENY' - Value for X-Frame-Options header.
       contentTypeOptions: 'nosniff', // default: 'nosniff' - Value for X-Content-Type-Options header.
@@ -40,9 +38,17 @@ export default {
 };
 ```
 
-In server configuration, set the CSP header similarly to vite-plugin-csp-dev. `NONCE_PLACEHOLDER` should be replaced with a generated nonce value for each request. For example, in nginx:
+## How It Works
 
-```
+**Development:** Plugin generates a nonce and sets CSP headers via middleware.
+
+**Production:** Plugin injects `NONCE_PLACEHOLDER` in HTML. Your web server replaces it with a real nonce per request.
+
+## Server Configuration
+
+**Nginx example:**
+
+```nginx
 map $request_id $nonce {
     ~. $request_id;
 }
@@ -52,7 +58,19 @@ server {
     sub_filter_types *;
     sub_filter NONCE_PLACEHOLDER $nonce;
 
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'nonce-$nonce'; style-src 'self' 'nonce-$nonce'; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; connect-src: 'self'; frame-ancestors 'none'; worker-src 'self'; upgrade-insecure-requests;";
+    add_header Content-Security-Policy "default-src 'self';
+        script-src 'self' 'nonce-$nonce';
+        style-src 'self' 'nonce-$nonce';
+        img-src 'self' data:;
+        font-src 'self';
+        object-src 'none';
+        base-uri 'self';
+        form-action 'self';
+        frame-ancestors 'none';
+        worker-src 'self';
+        connect-src 'self';
+        upgrade-insecure-requests;
+    " always;
     add_header X-XSS-Protection "1; mode=block";
     add_header X-Frame-Options "DENY";
     add_header X-Content-Type-Options "nosniff";

package/dist/index.js

@@ -3,7 +3,7 @@ const L = () => B("sha256").update(Date.now().toString()).digest("base64");
 function I(w = {}) {
   const {
     reportOnly: N = !1,
-    processI18n: v = !0,
+    processI18n: v = !1,
     defaultSrc: S = "'self'",
     noncePlaceholder: C = "NONCE_PLACEHOLDER",
     xssProtection: p = "1; mode=block",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-csp-dev",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "type": "module",
   "description": "A Vite plugin to add Content Security Policy (CSP) headers to your application in serve mode.",
   "main": "./dist/index.js",