@ampproject/toolbox-script-csp
Advanced tools
A library that calculates the CSP hash for amp-script
Calculates the Content Security Policy (CSP)
hash for the given script in the format expected by amp-script.
CSP is required when using amp-script with inline or cross-origin scripts.
Install via:
$ npm install @ampproject/toolbox-script-csp
The module exposes a single function, calculateHash(src, options?).
src can be either a string (in which case UTF8 encoding is assumed) or a
DataView
such as a Buffer.
options is used to override the default options.
algorithm overrides the hashing algorithm to use. Currently, the only
algorithm supported by amp-script is sha384 which is the default value.Here is an example on how to use the calculateHash function to generate an
amp-script CSP header.
Note that both leading and trailing whitespace is included in calculating the hash and must exactly match the whitespace used in the inline script.
const {calculateHash} = require('@ampproject/toolbox-script-csp');
const script = `
const subject = 'world';
console.log('Hello, ' + subject);
`;
const hash = calculateHash(script);
console.log(hash); // sha384-xRxb5sv13at6tVgZET4JLmf89TSZP10HjCGXVqO9bKWVXB0asV2jLrsDN8v4zX6j
The generated hash can be used in a <meta> tag this way:
<!doctype html>
<html ⚡>
<head>
...
<meta name="amp-script-src" content="sha384-xRxb5sv13at6tVgZET4JLmf89TSZP10HjCGXVqO9bKWVXB0asV2jLrsDN8v4zX6j">
</head>
<body>
...
<amp-script layout="container" script="example"></amp-script>
<script id="example" type="text/plain" target="amp-script">
const subject = 'world';
console.log('Hello, ' + subject);
</script>
</body>
</html>
FAQs
A library that calculates the CSP hash for amp-script
We found that @ampproject/toolbox-script-csp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 16 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.