Content Security Policy

Th' theme writes no inline JavaScript. Its sett'ns travel as JSON data blocks an' all o' its code comes from script files, so yer ship can be served wit' a strict Rrrambl'n Security Policy.

Policy

This policy covers every feature o' th' theme except Merrrmaid

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:

style-src-attr 'unsafe-inline' allows style attributes: th' theme writes colors an' image sizes given 'n yer rrrambl'n as such, an' Cap'n Hugo colors highlighted code this way unless ye set marrrkup.highlight.noClasses=false. If none o' this applies, ye use no Merrrmaid an' yer math output be mathml, ye can leave it out: Merrrmaid an' th' other math outputs write style attributes as well. Inline <style> elements stay forbidden; th' theme writes none.

What Needs More

• Merrrmaid: Merrrmaid writes its styles into inline <style> elements. Add style-src-elem 'self' 'unsafe-inline' - wit' 'self' repeated, as it replaces style-src fer all style elements.
• Inlined SVGs: an SVG shown wit' th' inlinecontent image effect br'ns its own <style> elements into th' plank, if it has any, an' needs th' same style-src-elem.
• Libraries from elsewhere: if ye set customMermaidURL or customOpenapiURL, add their origin t' script-src, an' fer Swagger UI t' style-src as well.
• Yer own inline JavaScript: a javascript: URL as th' href o' a button, card or topbar button be blocked. Give it an action instead an' handle that 'n a script file.

Subresource Integrity

Set enableSubresourceIntegrity=true t' have th' theme add an integrity hash t' each script an' stylesheet it links, includ'n th' search index an' th' stylesheets o' th' OpenAPI shortcode. A browser then refuses a file that changed after th' build.

[params]
  enableSubresourceIntegrity = true

params:
  enableSubresourceIntegrity: true

{
   "params": {
      "enableSubresourceIntegrity": true
   }
}