Skip to content

CSP: Missing support for latest style and script aka CSP level 3 #16233

@L1ghtn1ng

Description

@L1ghtn1ng

Astro Info

Astro                    v6.1.3
Vite                     v7.3.1
Node                     v22.22.1
System                   Linux (x64)
Package Manager          npm
Output                   static
Adapter                  @astrojs/cloudflare (v13.1.7)
Integrations             @astrojs/starlight (v0.38.2)

If this issue only occurs in one browser, which browser is a problem?

All

Describe the Bug

In astro with the csp enabled, you cannot set script-src-elem and style-src-attr primitives which are the newer endpoints to use so you get csp errors in the browser console which you can see for example on flasgo. There could be more than one bug here, being due to astro not handling these primitives and possibly starlight doing things that makes it also fail the csp, but if there is a bug with starlight its being clouded by astro not having/generating those primitives I mentioned before.

What's the expected result?

Be able to put them in your astro config file and not make the build error out and or auto generate the primitives like is done for script-src and style-src

Link to Minimal Reproducible Example

https://stackblitz.com/edit/github-czqujyie?file=astro.config.mjs

Participation

  • I am willing to submit a pull request for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    - P2: nice to haveNot breaking anything but nice to have (priority)pkg: astroRelated to the core `astro` package (scope)

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions