Skip to content
This repository has been archived by the owner on Mar 14, 2024. It is now read-only.

CSP

Jump to bottom
Sam Thorogood edited this page Oct 14, 2021 · 3 revisions

The CSP policy is mostly implemented here. This section inlines a number of built-in scripts as well as any inlineScripts found in a page's front matter.

Detailed Design

  1. Any script that is run inlined on the site's HTML is passed through a cspHash filter
  2. That filter eventually writes out to a file
  3. That file is read and combined as part of generating the "firebase.json" config file
  4. Firebase will send back those headers in response to any request (not just for the specific page which uses a single script) to web.dev.
  5. Browsers will see that list of CSP hashes and know that those specific scripts are safe.

External Scripts

We set the CSP "strict-dynamic" keyword which allows external scripts included by an authorized script to run. See MDN for more information.

These are scripts indicated by pageScripts in a page's front matter. Specifically, this means that those pageScripts do not need to be hashed.

Clone this wiki locally