npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

makestatic-csp

v1.0.8

Published

Generate CSP meta and nonces

Downloads

4

Readme

Content Security Policy

Generate content security policy meta elements and nonces



Install

yarn add makestatic-csp

API

ContentSecurityPolicy

Inject file specific content security policy meta elements.

For each HTML file inspect the plugin rules and inject a meta element for each matched rule. When the styles or scripts options are used it will also generate content security policies using the nonce algorithm and add the nonce values as attributes to the inline elements.

Requires that the parse-html and parse-csp plugins have been enabled for the parse phase as it operates on the HTML and CSP abstract syntax trees.

Enable this plugin for the transform phase.

See Also

ContentSecurityPolicy

new ContentSecurityPolicy(context, options)

Create a ContentSecurityPolicy plugin.

Use this plugin during the transform phase, you should enable the parse-csp and parse-html plugins for the parse phase.

This plugin uses a default content security policy parsed from csp.txt,

When the watch option is set this plugin will automatically include a connect-src policy with the ws://localhost:* and http://localhost:* values so that browsersync will work as expected.

A rule consists of a test regular expression pattern and the policy to merge with the parsed content security policy abstract syntax tree.

{
  rules: [
    {
      test: /news\//,
      file: 'news-csp.txt',
      policy: {
        'default-src': ['self'],
        'frame-src': ['none']
      }
    }
  ]
}

Use the file rule field when you want to use a default policy from an alternative content security policy file.

If no test pattern is specified for a rule it will apply to all files this plugin matches.

Use the styles and scripts options to generate content security policies for inline elements using the nonce algorithm. This will add nonce attributes to the inline elements and update the content security policy to include the generated nonce values.

The generated nonce value is a base64 encoded string of 32 random bytes generated by crypto.randomBytes(), you can use the bytes option to change the number of bytes used.

  • context Object the processing context.
  • options Object plugin options.
Options
  • rules Array list of file match rules.
  • bytes Number=32 number of bytes to use for the nonce.
  • styles String generate inline style policies.
  • scripts String generate inline script policies.
Throws
  • Error if the rules option is not an array.

.before

ContentSecurityPolicy.prototype.before(context, options)

Configure the list of matched files.

  • context Object the processing context.
  • options Object plugin options.

.sources

ContentSecurityPolicy.prototype.sources(file, context, options)

Find the first matching rule for a file.

  • file File the current file.
  • context Object the processing context.
  • options Object plugin options.

.after

ContentSecurityPolicy.prototype.after(context, options)

Rewrite file content.

  • context Object the processing context.
  • options Object plugin options.

License

MIT


Created by mkdoc on March 12, 2017