@manta-eu/horns-server/csp

Functions

contentSecurityPolicy()

contentSecurityPolicy(sentryDsn): string

connect-src is the point of this. Everything else is the cheap part of the same idea.

'unsafe-eval' is not an oversight: the written-view runtime compiles a view with new Function, and without it no written view draws at all. That is the trade the realm-sharing design already made, and the reason connect-src carries the weight here.

Parameters

sentryDsn

string | undefined

Returns

string