Set a CSP policy

[aciccarello]

Want to avoid scripts and things getting injected into the site unexpectedly.

Resources to enable

• self hosted scripts & styles
• inline scripts & styles via hash at build time
• twitter and youtube embeded content
• webmention rendering code
• cloudflare analytics

Tools

• netlify-plugin-csp-generator
• eleventy-high-performance-blog csp plugin
• CSP Reporting site has free tier up to 10,000 reports

Docs

• MDN CSP Docs
• Mozilla Security Guidelines

[jackdbd]

Hi! I stumbled upon your website while I was looking for people that use Indiekit with 11ty.

I created @jackdbd/content-security-policy to define all CSP directives in JS instead of plain text. I have been using it for a few months on my 11ty blog. This tool does not write an entire CSP for you (I think it would be a silly idea), but it automatically computes the hashes of each snippet of CSS/JS that you inline in your HTML files. And it validates your CSP directives with Zod.

Another SaaS that deals with CSP and sends you report violations is uriports. You can consider it an alternative to Report URI.

[aciccarello]

Nice! That's for sharing! That looks super useful. I'll have to try it out.