Support CSP headers generation for static content on Cloudflare

[castarco]

To improve the usability of Astro-Shield, it would be good to support the generation of headers metadata specific for the Cloudflare provider, so we can generate CSP headers for static content.

Reference

• See public/_headers file
• See https://docs.astro.build/en/guides/integrations-guide/cloudflare/#headers

[jacobpretorius]

I've hacked together a very simple temporary workaround for anyone who needs to get going with SRI headers in their CSP with Cloudflare Pages while this actual proper implementation is open.

Feel free to use the code snippets in my example to do the same if you want.

[yudyananda]

Feel free to use the code snippets in my example to do the same if you want.

@jacobpretorius it's kinda work but i wonder why the browser ignore Content-Security-Policy with multiple subresource integrity

[valtism]

CloudFlare uses the same headers file as Netlify. If you want to use this with CF, just set enableOnStaticPages: { provider: "netlify" } and you're good

[jacobpretorius]

I'm not sure about that @valtism I tried it and it didn't quite work. The file may be the same but the formatting CF needs is different from what I recall. Or maybe it's just the more advanced use case where you want to have other directives defined as well.

This is what I tried and gave up with before I hacked together my own solution