feat: stabilize CSP #12859

ematipico · 2025-12-08T13:32:44Z

Description (required)

This PR stabilise the CSP APIs.

Moves the CSP APIs and configuration in the proper sections.

I only moved the content, I didn't update the current wording.

Also, I took the liberty to refactor the security section because it became quite lenghty, so I thought it required a proper header now.

For Astro version: `6.0`. See astro PR #14946.

netlify · 2025-12-08T13:32:51Z

✅ Deploy Preview for astro-docs-2 ready!

Name	Link
🔨 Latest commit	`1fb8ea9`
🔍 Latest deploy log	https://app.netlify.com/projects/astro-docs-2/deploys/6939f89b26ea3b00088ab6c8
😎 Deploy Preview	https://deploy-preview-12859--astro-docs-2.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

astrobot-houston · 2025-12-08T13:33:24Z

Lunaria Status Overview

🌕 This pull request will trigger status changes.

Learn more

By default, every PR changing files present in the Lunaria configuration's files property will be considered and trigger status changes accordingly.

You can change this by adding one of the keywords present in the ignoreKeywords property in your Lunaria configuration file in the PR's title (ignoring all files) or by including a tracker directive in the merged commit's description.

Tracked Files

File	Note
en/reference/api-reference.mdx	Source changed, localizations will be marked as outdated.
en/reference/configuration-reference.mdx	Source changed, localizations will be marked as outdated.
en/reference/experimental-flags/csp.mdx	Source changed, localizations will be marked as outdated.

Warnings reference

Icon	Description
🔄️	The source for this localization has been updated since the creation of this pull request, make sure all changes in the source have been applied.

sarah11918 · 2025-12-08T19:01:48Z

Thanks @ematipico ! We'll also need to add something to the v6 upgrade guide at https://deploy-preview-12322--astro-docs-2.netlify.app/en/guides/upgrade-to/v6/#experimental-flags

This flag can be added to the block of all the flags being removed, then probably just a very similar entry under https://deploy-preview-12322--astro-docs-2.netlify.app/en/guides/upgrade-to/v6/#experimental-features-now-stable to the existing failOnPrerenderConflict:

csp (See the new security.csp configuration option.)

sarah11918

This looks great, @ematipico !

I think the bulk of the work is going to be figuring out how to make the config reference stuff as concise as possible, and I've left a bunch of suggestions about doing that.

Also, the experimental-flags/csp.mdx page can be completely deleted, and should be removed from the Astro sidebar

src/content/docs/en/reference/configuration-reference.mdx

sarah11918 · 2025-12-08T19:49:35Z

src/content/docs/en/reference/configuration-reference.mdx

+Enabling this feature adds additional security to **Astro's handling of processed and bundled scripts and styles** by default, and allows you to further configure these, and additional, content types.
+
+This experimental CSP feature has some limitations. Inline scripts are not supported out of the box, but you can [provide your own hashes](#hashes) for external and inline scripts. [Astro's view transitions](/en/guides/view-transitions/) using the `<ClientRouter />` are not supported, but you can [consider migrating to the browser native View Transition API](https://events-3bg.pages.dev/jotter/astro-view-transitions/) instead if you are not using Astro's enhancements to the native View Transitions and Navigation APIs.
+
+:::note
+Due to the nature of the Vite dev server, this feature isn't supported while working in `dev` mode. Instead, you can test this in your Astro project using `build` and `preview`.
+:::


We'll have to figure out how much of this we want to say here. Is it all still true with stabilization?

I updated the paragraph with a list of limitations

src/content/docs/en/reference/api-reference.mdx

src/content/docs/en/reference/configuration-reference.mdx

sarah11918 · 2025-12-09T22:22:24Z

Just noting that some of the failed links are on the experimental CSP page (which will be deleted) and I've suggested fixes to the others above. So, those should end up OK!

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

sarah11918

This review is called "Death by a thousand indentations" 😆

I am going to commit all of these that are just fixing indentation, and let you review the rest so that it's not quite so overwhelming, @ematipico . But, this looks fantastic! I hope you're happy with it!

src/content/docs/en/reference/api-reference.mdx

src/content/docs/en/reference/configuration-reference.mdx

sarah11918 · 2025-12-10T22:27:20Z

src/content/docs/en/reference/configuration-reference.mdx

+```js title="astro.config.mjs"
+import { defineConfig } from 'astro/config';
+
+export default defineConfig({


It might be helpful if one of these examples showed e.g. unsafe-inline or something related to the subclasses, just so there's an example of both things!

src/content/docs/en/reference/configuration-reference.mdx

sarah11918 · 2025-12-10T22:41:04Z

src/content/docs/en/reference/api-reference.mdx

+
+Inserts a new valid source to be used for the `script-src` directive.
+
+```astro


Suggested change

```astro

```astro title="src/pages/index.astro"

src/content/docs/en/reference/api-reference.mdx

sarah11918 · 2025-12-10T22:41:47Z

src/content/docs/en/reference/api-reference.mdx

+
+Adds a new hash to the `script-src` directive.
+
+```astro


Suggested change

```astro

```astro title="src/pages/index.astro"

src/content/docs/en/reference/api-reference.mdx

src/content/docs/en/reference/configuration-reference.mdx

feat: stabilize CSP

e412ff1

ematipico added the 6.0 label Dec 8, 2025

ematipico mentioned this pull request Dec 8, 2025

feat: stabilise CSP withastro/astro#14946

Open

sarah11918 reviewed Dec 8, 2025

View reviewed changes

sarah11918 reviewed Dec 9, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 9, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 9, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

ematipico and others added 6 commits December 10, 2025 19:11

Apply suggestions from code review

a7578e2

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

Apply suggestion from @sarah11918

15f4d62

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

Apply suggestion from @sarah11918

e3c1445

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

Apply suggestion from @sarah11918

586cfcf

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

Apply suggestion from @sarah11918

793bd14

Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com>

update wording of limitations

fd38fcd

sarah11918 reviewed Dec 10, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 10, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 10, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 10, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 10, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 10, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

sarah11918 reviewed Dec 10, 2025

View reviewed changes

src/content/docs/en/reference/configuration-reference.mdx Outdated Show resolved Hide resolved

Indentation and other syntax fixes

1fb8ea9


		Inserts a new valid source to be used for the `script-src` directive.

		```astro

Uh oh!

feat: stabilize CSP #12859

Are you sure you want to change the base?

feat: stabilize CSP #12859

Conversation

ematipico commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description (required)

For Astro version: 6.0. See astro PR #14946.

Uh oh!

netlify bot commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for astro-docs-2 ready!

Uh oh!

astrobot-houston commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Lunaria Status Overview

Tracked Files

Uh oh!

sarah11918 commented Dec 8, 2025

Uh oh!

sarah11918 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sarah11918 Dec 8, 2025

Choose a reason for hiding this comment

Uh oh!

ematipico Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sarah11918 commented Dec 9, 2025

Uh oh!

sarah11918 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sarah11918 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sarah11918 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sarah11918 Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ematipico commented Dec 8, 2025 •

edited

Loading

For Astro version: `6.0`. See astro PR #14946.

netlify bot commented Dec 8, 2025 •

edited

Loading

astrobot-houston commented Dec 8, 2025 •

edited

Loading