gatsby-plugin-csp
gatsby-plugin-csp copied to clipboard
bejamas
HTTP headers support
I would like to suggest adding a new option in the plugin to flush all CSP header directives to a file in .cache directory which would allow other plugins to interact with.
For instance, gatsby-plugin-s3 would be able to pick it up and merge with their own params, which would then upload custom Metadata to S3 (then serve Content-Security-Policy as header).
Other plugins such as gatsby-plugin-netlify would be able to implement the same action.
Cross reference to https://github.com/jariz/gatsby-plugin-s3/issues/144
@lightningspirit I agree, this feature would make server-side CSP implementation a lot easier.
Do you know of any alternate solutions/workarounds for a header-based approach?
@lightningspirit I agree, this feature would make server-side CSP implementation a lot easier.
Do you know of any alternate solutions/workarounds for a header-based approach?
Actually, after a couple of tests, I ended up not using this plugin at all. Instead, I only used https://github.com/jariz/gatsby-plugin-s3/issues/144 and decided to hardcode my Content-Security-Policy in plugin's configs for headers.