JSPM

content-security-policy-merger

1.0.0
  • ESM via JSPM
  • ES Module Entrypoint
  • Export Map
  • Keywords
  • License
  • Repository URL
  • TypeScript Types
  • README
  • Created
  • Published
  • Downloads 881
  • Score
    100M100P100Q110349F
  • License MIT

Merge Content-Security-Policy directives

Package Exports

  • content-security-policy-merger
  • content-security-policy-merger/index.js

This package does not declare an exports field, so the exports above have been automatically detected and optimized by JSPM instead. If any package subpath is missing, it is recommended to post an issue to the original package (content-security-policy-merger) to support the "exports" field. If that is not possible, create a JSPM override to customize the exports field for this package.

Readme

Testing

Content Security Policy merger

Merge two Content-Security-Policy strings together.

Usage:

import { merge } from 'content-security-policy-merger'

const cspA =
  "default-src 'self' *.example.com example.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.youtube.com; frame-src 'self' players.brightcove.net; img-src 'blob' 'self'; style-src 'unsafe-inline' https:"

const cspB =
  "default-src 'self' *.mysite.com mysite.com; script-src 'self' www.google-analytics.com; frame-src 'self' example.com; manifest-src 'self'; style-src 'unsafe-inline'"

merge(cspA, cspB)

// default-src 'self' *.example.com *.mysite.com example.com mysite.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google-analytics.com www.youtube.com; frame-src 'self' example.com players.brightcove.net; img-src 'blob' 'self'; style-src 'unsafe-inline' https:; manifest-src 'self'

Related projects: