Dynamic parts of CSP

[kwesterfeld2]

Is it possible to alter the configuration of my application to add to two parts of the CSP generated for each page?

I want to be able to add to the connect-src and frame-src portions of the CSP served by my app.

I am planning on using nitro for some of the API endpoints I have to build, but not too familiar with how a request/response can be filtered. I would think I can get/set headers during the request pipeline but this seems messy.

[vejja]

You can set

defineNuxtConfig({
  security: {
    headers: {
      contentSecurityPolicy: {
        "connect-src": [...],
        "frame-src": [...],
      }
    }
  }
})

[kwesterfeld2]

Yes I'm doing this during build. What I want to do is do this at runtime, augmenting these two values with configuration set after deployment.

[Baroshem]

Hey I think that this will be added with this PR #298 (comment)