| name | astro-security |
| description | Use when configuring Content Security Policy (CSP) in Astro 7, setting security headers, managing script/style hashes, using nonces, or implementing experimentalStaticHeaders for adapter deployments. |
Astro Security
Targets: Astro 7.
Agent Workflow (MANDATORY)
Before ANY implementation, spawn 3 parallel agents (Codex spawn_agent):
- explore-codebase - Analyze existing security config, adapters, headers
- research-expert - Verify latest Astro 7 CSP docs via Context7/Exa
- Context7 (official docs) - Check CSP compatibility with deployment adapter
After implementation, run sniper for validation.
Overview
When to Use
- Enabling CSP in an Astro project (stable in v6.0.0)
- Configuring
security.csp in astro.config.mjs
- Adding SHA-256/384/512 hashes for external scripts or styles
- Using nonces for dynamic script injection
- Setting up
experimentalStaticHeaders for adapter-based CSP headers
CSP in Astro
Astro 6 ships Content Security Policy as a stable feature (previously experimental). When enabled:
- Astro automatically generates SHA hashes for all bundled scripts and styles
- Injects a
<meta http-equiv="content-security-policy"> in each page's <head>
- Supports
script-src and style-src directives by default
Limitations:
- Not supported in
dev mode — test with build + preview
- External scripts and styles require manual hash configuration
- Incompatible with
<ClientRouter /> view transitions (use native View Transition API)
- Shiki syntax highlighter (inline styles) not currently supported
Reference Guide
Concepts
Templates
Best Practices
- Always test with build + preview — CSP is inactive in dev mode
- Start with SHA-512 — strongest hash algorithm
- Use
'self' explicitly — not included by default in resources
- Hash external scripts manually — compute SHA hashes for CDN resources
- Combine with adapter headers — use
experimentalStaticHeaders for Vercel/Netlify
Forbidden
- Testing CSP in
dev mode (doesn't work — always use build + preview)
- Using
<ClientRouter /> with CSP enabled
- Forgetting to add
'self' when using resources array
- Adding
unsafe-inline (defeats purpose of CSP)
