Add support for CSP in `.htaccess`
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 20.8k
- Forks
- 2.3k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 156
Description
Describe the problem
I'm trying to use CSP on an Apache server with adapter-static. I'd like to add CSP, however, my CSP for the site is in .htaccess, while SvelteKit puts the hashes in a header, therefore the scripts are blocked by the CSP from .htaccess.
Describe the proposed solution
I would like to be able to take the generated CSP from SvelteKit and append it to my .htaccess (which I have as a static file)
Alternatives considered
Only using header CSP, however, these do not apply to assets other that SvelteKit generated HTML files
Importance
would make my life easier
Additional Information
Willing to submit a PR.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with adapter-static's generated output and the existing CSP header generation, then trace how the generated hashes are exposed for static deployments. Define how that CSP can be appended to a static .htaccess file while still covering SvelteKit-generated scripts and other assets.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, web-dev
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100