Skip to content

feat(csp): fix CSP header, inject astro island script/style#13687

Merged
ematipico merged 4 commits into
feat/cspfrom
feat/csp-astro-island
Apr 28, 2025
Merged

feat(csp): fix CSP header, inject astro island script/style#13687
ematipico merged 4 commits into
feat/cspfrom
feat/csp-astro-island

Conversation

@ematipico
Copy link
Copy Markdown
Member

@ematipico ematipico commented Apr 25, 2025

Changes

  • Fixes the content that should be passed to the CSP meta tag. Its content must be the same as the CSP response header
  • Reworked the prebuilt hashes to contain their name so that we can distinguish styles from scripts
  • If Astro detected some renderers, we assume that the user will use some client components, so we add the hashes of Astro Island (style and script), Astro client directives (all of them for now, because we don't know yet which ones are used when rendering the head)

Testing

Added a new test with React, and updated the existing assertions to check for Astro Island script and style

Docs

N/A

@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented Apr 25, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: 342014d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions Bot added pkg: astro Related to the core `astro` package (scope) docs pr labels Apr 25, 2025
@ematipico ematipico merged commit d2482b3 into feat/csp Apr 28, 2025
15 checks passed
@ematipico ematipico deleted the feat/csp-astro-island branch April 28, 2025 12:06
ematipico added a commit that referenced this pull request May 1, 2025
@ematipico
feat(csp): fix CSP header, inject astro island script/style (#13687)
ae66730
ematipico added a commit that referenced this pull request May 1, 2025
@ematipico @florian-lefebvre @ascorbic
feat(csp): support view transitions (#13738)
5c0f24d 
Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
fix CSP header, inject astro island script/style (#13687)
ematipico added a commit that referenced this pull request May 14, 2025
@ematipico
feat(csp): fix CSP header, inject astro island script/style (#13687)
b3c65fa
ematipico added a commit that referenced this pull request May 14, 2025
@ematipico @florian-lefebvre @ascorbic
feat(csp): support view transitions (#13738)
92bc2ae 
Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
fix CSP header, inject astro island script/style (#13687)
ematipico added a commit that referenced this pull request May 22, 2025
@ematipico
feat(csp): fix CSP header, inject astro island script/style (#13687)
77bceec
ematipico added a commit that referenced this pull request May 22, 2025
@ematipico @florian-lefebvre @ascorbic
feat(csp): support view transitions (#13738)
e63013b 
Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
fix CSP header, inject astro island script/style (#13687)
ascorbic added a commit that referenced this pull request Jun 4, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot
feat: experimental CSP (#13802)
0eafe14 
* chore: build hashes of scripts (#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (#13675)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): fix CSP header, inject astro island script/style (#13687)

* feat(csp): track client scripts and CSS (#13725)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): support view transitions (#13738)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
fix CSP header, inject astro island script/style (#13687)

* feat(csp): server islands (#13775)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): customise algorithm (#13803)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* chore: build hashes of scripts (#13590) (#13805)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* feat(csp): allow additional directives (#13810)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): resources for script and styles directives (#13812)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): runtime APIs (#13824)

Co-authored-by: Matt Kane <m@mk.gg>

* feat(csp): add script-dynamic keyword support (#13834)

* update lockfile

* chore: docs and changeset (#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

---------

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>
openscript pushed a commit to openscript/astro that referenced this pull request Sep 12, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot @openscript
feat: experimental CSP (withastro#13802)
1d9a567 
* chore: build hashes of scripts (withastro#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (withastro#13675)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): track client scripts and CSS (withastro#13725)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): support view transitions (withastro#13738)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): server islands (withastro#13775)

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): customise algorithm (withastro#13803)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* chore: build hashes of scripts (withastro#13590) (withastro#13805)

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

* feat(csp): allow additional directives (withastro#13810)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>

* feat(csp): resources for script and styles directives (withastro#13812)

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

* feat(csp): runtime APIs (withastro#13824)

Co-authored-by: Matt Kane <m@mk.gg>

* feat(csp): add script-dynamic keyword support (withastro#13834)

* update lockfile

* chore: docs and changeset (withastro#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

---------

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com>
Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>
Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>
Co-authored-by: Matt Kane <m@mk.gg>
Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>
Co-authored-by: Armand Philippot <git@armand.philippot.eu>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@florian-lefebvre florian-lefebvre florian-lefebvre approved these changes

Assignees

No one assigned

Labels

docs pr pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ematipico @florian-lefebvre