vite-plugin-csp-dev 1.0.5 → 1.0.6

package/README.md

@@ -1,8 +1,6 @@
 # vite-plugin-csp-dev
 
-A Vite plugin to add Content Security Policy (CSP) headers to your application in serve mode.
-
-In order to set CSP headers in production builds, you must configure your web server accordingly. This plugin transforms build output in order to facilitate that.
+Vite plugin for Content Security Policy with nonce support. Adds CSP headers in development and injects nonce placeholders in production builds for server-side replacement.
 
 ## Usage
 
@@ -15,9 +13,9 @@ export default {
   plugins: [
     secureHeaders({
       reportOnly: false, // default: false - Report CSP violations instead of blocking them.
-      processI18n: true, // default: true - Process i18n.
+      processI18n: false, // default: false - Process i18n.
       defaultSrc: "'self'", // default: "'self'" - Value for default-src directive in CSP.
-      noncePlaceholder: 'NONCE_PLACEHOLDER', // default: 'NONCE_PLACEHOLDER' - Placeholder for nonce in HTML.
+      noncePlaceholder: 'NONCE_PLACEHOLDER', // default: 'NONCE_PLACEHOLDER' - Placeholder replaced by server.
       xssProtection: '1; mode=block', // default: '1; mode=block' - Value for X-XSS-Protection header.
       frameOptions: 'DENY', // default: 'DENY' - Value for X-Frame-Options header.
       contentTypeOptions: 'nosniff', // default: 'nosniff' - Value for X-Content-Type-Options header.
@@ -40,7 +38,15 @@ export default {
 };
 ```
 
-In server configuration, set the CSP header similarly to vite-plugin-csp-dev. `NONCE_PLACEHOLDER` should be replaced with a generated nonce value for each request. For example, in nginx:
+## How It Works
+
+**Development:** Plugin generates a nonce and sets CSP headers via middleware.
+
+**Production:** Plugin injects `NONCE_PLACEHOLDER` in HTML. Your web server replaces it with a real nonce per request.
+
+## Server Configuration
+
+**Nginx example:**
 
 ```nginx
 map $request_id $nonce {

package/dist/index.js

@@ -3,7 +3,7 @@ const L = () => B("sha256").update(Date.now().toString()).digest("base64");
 function I(w = {}) {
   const {
     reportOnly: N = !1,
-    processI18n: v = !0,
+    processI18n: v = !1,
     defaultSrc: S = "'self'",
     noncePlaceholder: C = "NONCE_PLACEHOLDER",
     xssProtection: p = "1; mode=block",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-csp-dev",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "type": "module",
   "description": "A Vite plugin to add Content Security Policy (CSP) headers to your application in serve mode.",
   "main": "./dist/index.js",