vite-plugin-csp weekly downloads statistics

CSP (Content-Security-Policy) Vite Plugin

<!-- cspell: disable bracketsstartstop -->

Leverages csp-typed-directives to create typed CSP <meta> policies and validated interdependant headers. e.g. the CSP, CSP Report-Only, Report-To, and Referrer-Policy headers.

Mostly config compatible with csp-html-webpack-plugin

WARNING, STILL EARLY AND THINGS LIKE MODULE RESOLUTION ARE FINICKY

Now looking at making a multi-repo because this is going to require multiple layers of shared functionality and also built to an unplugin

Installation

Install the plugin with npm:

$ npm install --save-dev vite-plugin-csp
# Or shorthand
npm i -D vite-plugin-csp

Known issues

• Relative modules are resolved relative to the CWD, not the file
• no SSR support (and thus no nonce support)
• No parsing of JS embeded sources (since that would require framework specific plugins)
• Only script and style related directives are supported (except for the inclusion of report-to for generating headers)

Under construction :)

<!-- ## Zero Config Usage Add your base logo as `logo.png` file to your assets folder. Add the plugin to your vite config as follows: ```javascript const ViteCspPlugin = require('vite-plugin-csp') // or ESM import { ViteCspPlugin } from "module"; plugins: [ ViteCspPlugin() ] ``` ## Basic Usage <!-- [<svg alt="codesandbox" xmlns="http://www.w3.org/2000/svg" width="16" height="18"><path d="M7.219 15.877V9.394l-5.73-3.208v3.696l2.624 1.48v2.78l3.106 1.735zm1.488.038l3.163-1.773v-2.845l2.642-1.49V6.16l-5.805 3.26v6.496zm5.041-11l-3.05-1.72-2.68 1.512L5.32 3.193 2.241 4.937l5.744 3.215 5.763-3.237zM0 13.513V4.53L8 0l8 4.511V13.5l-8.001 4.484L0 13.513z" fill="currentColor"/></svg>](https://codesandbox.io/s/vite-plugin-csp-demo-uh195?file=/webpack.config.js) --> <!-- Add the plugin to your vite config as follows: ```javascript const ViteCspPlugin = require('vite-plugin-csp') // or ESM import { ViteCspPlugin } from "module"; ... plugins: [ ViteCspPlugin('/path/to/logo.png') // svg works too! ] ``` The default configuration will automatically generate webapp manifest files along with [44 different icon formats](https://github.com/josh-hemphill/vite-plugin-csp/tree/master/test/fixtures/expected/default) as appropriate for iOS devices, Android devices, Windows Phone and various desktop browsers out of your single `logo.png`. > **Tip:** You might want to [fine tune](#advanced-usage) what vendors to support. ### A Note on Path Resolution Under the hood, Vite/Rollup resolve the paths to the logo and favicons according to the following rules: * If `/path/to/logo` is absolute, there is nothing to resolve and the path specified is used as is. * If `./path/to/logo` is relative, it's resolved with respect to `process.cwd()`. ### HTML Injection In combination with [Vite's html plugin hooks](https://vitejs.dev/guide/api-plugin.html#transformindexhtml) it will also inject the necessary html for you:…