Content Security Policy

The theme writes no inline JavaScript. Its settings travel as JSON data blocks and all of its code comes from script files, so your site can be served with a strict Content Security Policy.

Policy

This policy covers every feature of the theme except Mermaid and math

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:

style-src-attr 'unsafe-inline' allows style attributes: the theme writes colors and image sizes given in your content as such, and Hugo colors highlighted code this way unless you set markup.highlight.noClasses=false. If none of this applies and you use neither Mermaid nor math, which write style attributes as well, you can leave it out. Inline <style> elements stay forbidden; the theme writes none.

What Needs More

• Mermaid: Mermaid writes its styles into inline <style> elements. Add style-src-elem 'self' 'unsafe-inline' - with 'self' repeated, as it replaces style-src for all style elements.
• Math: MathJax does the same and needs the same style-src-elem. It also starts a worker from a blob: URL and loads its fonts from https://cdn.jsdelivr.net, so add worker-src blob: and https://cdn.jsdelivr.net to font-src.
• Inlined SVGs: an SVG shown with the inlinecontent image effect brings its own <style> elements into the page, if it has any, and needs the same style-src-elem.
• Libraries from elsewhere: if you set customMathJaxURL, customMermaidURL or customOpenapiURL, add their origin to script-src, and for Swagger UI to style-src as well.
• Your own inline JavaScript: a javascript: URL as the href of a button, card or topbar button is blocked. Give it an action instead and handle that in a script file.

Subresource Integrity

Set enableSubresourceIntegrity=true to have the theme add an integrity hash to each script and stylesheet it links, including the search index and the stylesheets of the OpenAPI shortcode. A browser then refuses a file that changed after the build.

[params]
  enableSubresourceIntegrity = true

params:
  enableSubresourceIntegrity: true

{
   "params": {
      "enableSubresourceIntegrity": true
   }
}