cspeasy

A simple way to setup Content Security Policy even with inline scripts and styles!

It digests HTML documents so you can have a strong CSP with necessary inline scripts and styles (e.g. Google Analytics).

Example

import { createServer } from "http";
import { readFile } from "fs";
import { ContentSecurityPolicy, Policies } from "../src/main";
import { resolve } from "path";

const server = createServer((req, res) => {
    const csp = new ContentSecurityPolicy({
        defaultSrc: Policies.None,
    });

    readFile(resolve("test/index.html"), null, (error, data) => {
        if (error) {
            throw error;            
        }

        const indexString = data.toString();

        const hashedCsp = csp.addDocument(indexString);

        res.setHeader("Content-Security-Policy", hashedCsp.getHeaderValue());

        res.end(indexString);
    });
});

const port = 3000;

server.listen(port, () => console.log(`listening on ${port}`));