diff --git a/README.md b/README.md index 8df956f..434a9b2 100644 --- a/README.md +++ b/README.md @@ -67,6 +67,42 @@ const App = () => { }; ``` +## Content Security Policy (CSP) + +react-hot-toast supports strict Content Security Policies through an opt-in strict CSP mode. + +### Default Mode + +By default, react-hot-toast uses inline styles for maximum flexibility. This requires `style-src 'unsafe-inline'` in your CSP. + +### Strict CSP Mode + +For applications with strict CSP that disallow inline styles, enable strict CSP mode: + +```jsx +import toast, { Toaster } from 'react-hot-toast'; + + +``` + +In strict CSP mode: +- All inline `style` props are ignored +- Styling must be done via CSS classes and CSS variables +- Toast positioning uses CSS flexbox instead of inline transforms +- Fully compatible with CSP `style-src 'nonce-...'` directives + +The library uses [goober](https://github.com/cristianbote/goober) for styling. To support CSP nonces, set `window.__nonce__` before your app loads: + +```html + +``` + +goober will automatically apply the nonce to its generated `