Skip to content

Astro Islands prevent CSP with inline styles and scripts #8719

@itsmatteomanf

Description

@itsmatteomanf

Astro Info

Astro                    v3.2.1
Node                     v18.17.1
System                   macOS (arm64)
Package Manager          pnpm
Output                   static
Adapter                  none
Integrations             @astrojs/svelte

Describe the Bug

Adding any Astro Island in the projects makes strict CSP support impossible, as both a style and a script tag are added to the HTML page, with inline styles forcing unsafe-inline.

I have set both build: {inlineStylesheets: "never"} and vite: { build: { assetsInlineLimit: 0 } }, but they do nothing with this.

Can that be bundled in the JS and CSS files?

What's the expected result?

Having JS and CSS bundled with the rest of the assets.

Link to Minimal Reproducible Example

https://stackblitz.com/edit/withastro-astro-issue-8719

Participation

  • I am willing to submit a pull request for this issue.

Metadata

Metadata

Assignees

No one assigned

    Labels

    needs triageIssue needs to be triaged

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions