ContentSecurityPolicy object

Use ContentSecurityPolicy to configure the Content-Security-Policy header.

Syntax

1interface ContentSecurityPolicy {
2    useDefaults: boolean;
3    reportOnly: boolean;
4    resourceHashing: boolean;
5    directives: { [key: string]: string[] };
6}

Options

Option	Description	Default Value
`useDefaults`	When `true`, it merges the default header directives with any custom directives you pass in via the `directives` object.	`false`
`reportOnly`	Set this option to one or more policy directives. For example: `default-src https:; report-to /csp-violation-report-endpoint/`	`'content-security-policy'`
`resourceHashing`	When `true`, inline scripts are hashed for the header.	`true`
`directives`	In this section, you can configure directives for the `Content-Security-Policy` header.

Directives

You can customize these directives for a Content-Security-Policy header. Set values for them in the directives section of a ContentSecurityPolicy object.

Example

For example, this ContentSecurityPolicy object tells the Content-Security-Policy header to use the media-src 'self' directive in addition to to the default directives.

1"contentSecurityPolicy":
2    {
3        "useDefault": true,
4        "resourceHashing": false,
5        "directives": "media-src 'self';"
6    }

This ContentSecurityPolicy has useDefaults: false, which removes all the default directives and values. It only defines a value for the media-src directive, so all other directives accept content from any source.

1"contentSecurityPolicy":
2    {
3        "useDefault": false,
4        "resourceHashing": false,
5        "directives": "media-src 'self';"
6    }

See Also

Guide: @lwrjs/security

Developer Preview Feature

Feature is available as a developer preview. Feature is not generally available unless or until Salesforce announces its general availability in documentation or in press releases or public statements. All commands, parameters, and other features are subject to change or deprecation at any time, with or without notice. Do not implement functionality developed with these commands or tools.

DID THIS ARTICLE SOLVE YOUR ISSUE?
Let us know so we can improve!