Documentation on using CSP for statically generated sites

[SeanPollock]

Hello,

I'm having some trouble understanding how to use the CSP generation feature of this project with a statically generated website. I believe the docs only specify how to use them for an SSR website where you can inject the headers via a server middleware, which is not present for statically generated websites.

I looked through the dist folder to see if the CSP values were output anywhere.

Is there a way to save the generated CSP as an output of the build step or a generated file that I can reference when I deploy my static site to a CDN?

Thanks!

[keke1210]

Same issue for me. I try to add this configuration but there are no CSP headers or meta tag inserted to the HTML:

import { defineConfig } from 'astro/config';
import { shield } from '@kindspells/astro-shield';

export default defineConfig({
  integrations: [
    shield({
      sri: {
        enableStatic: true,
        allowInlineScripts: 'all',
        allowInlineStyles: 'all',
      },
      securityHeaders: {
        contentSecurityPolicy: {
          cspDirectives: {
            'default-src': "'self'",
            'script-src': "'self' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/",
            'connect-src': "'self'",
            'img-src': "'self' https:",
            'font-src': "'self' https:",
          },
        },
      },
    }),
  ],
});

I am deploying on Vercel by the way

[castarco]

Hi @SeanPollock , @keke1210 , please excuse me for my super late response.

Astro-Shield does not provide this feature yet, but we have it in our roadmap. The way to do it today is not too complicated, though, although it requires some extra scripting:

1. Run the build process, and generate the "hashes module" (you can wee how in the documentation)
2. After the build, you can run a script that loads the "hashes module", and based on its content changes the configuration for your provider of choice (Vercel, Netlify, etc.)

The related issues are:

• Support CSP headers generation for static content on Cloudflare #63
• Support CSP headers generation for static content on Vercel #64
• Support CSP headers generation for static content on Netlify #65

[castarco]

Closing because we already have more specific issues covering the same problem exposed here.