Content Security Policy

Th' theme writes no inline JavaScript. Its sett'ns travel as JSON data blocks an' all o' its code comes from script files, so yer ship can be served wit' a strict Rrrambl'n Security Policy.

Policy

This policy covers every feature o' th' theme except Merrrmaid an' math

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:

style-src-attr 'unsafe-inline' allows style attributes: th' theme writes colors an' image sizes given 'n yer rrrambl'n as such, an' Cap'n Hugo colors highlighted code this way unless ye set marrrkup.highlight.noClasses=false. If none o' this applies an' ye use neither Merrrmaid nor math, which write style attributes as well, ye can leave it out. Inline <style> elements stay forbidden; th' theme writes none.

What Needs More

• Merrrmaid: Merrrmaid writes its styles into inline <style> elements. Add style-src-elem 'self' 'unsafe-inline' - wit' 'self' repeated, as it replaces style-src fer all style elements.
• Math: MathJax does th' same an' needs th' same style-src-elem. It also starts a worker from a blob: URL an' loads its fonts from https://cdn.jsdelivr.net, so add worker-src blob: an' https://cdn.jsdelivr.net t' font-src.
• Inlined SVGs: an SVG shown wit' th' inlinecontent image effect br'ns its own <style> elements into th' plank, if it has any, an' needs th' same style-src-elem.
• Libraries from elsewhere: if ye set customMathJaxURL, customMermaidURL or customOpenapiURL, add their origin t' script-src, an' fer Swagger UI t' style-src as well.
• Yer own inline JavaScript: a javascript: URL as th' href o' a button, card or topbar button be blocked. Give it an act'n instead an' handle that 'n a script file.

Subresource Integrity

Set enableSubresourceIntegrity=true t' have th' theme add an integrity hash t' each script an' stylesheet it links, includ'n th' search index an' th' stylesheets o' th' OpenAPI shortcode. A browser then refuses a file that changed after th' build.

[params]
  enableSubresourceIntegrity = true

params:
  enableSubresourceIntegrity: true

{
   "params": {
      "enableSubresourceIntegrity": true
   }
}