Guides
Blog
Practical writing on script-src and Content-Security-Policy.
-
Why your dev server breaks under script-src
Webpack wraps rebuilt modules in eval, Vite injects an inline preamble script, and HMR needs a websocket. What each dev server trips on under script-src, and the allowances to keep dev-only.
-
script-src nonces vs hashes: when to use which
A practical guide to allowlisting inline scripts under CSP script-src: nonces for dynamic pages, hashes for static ones, and the trade-offs of each.