@ampproject/toolbox-script-csp
Advanced tools
A library that calculates the CSP hash for amp-script
Calculates the Content Security Policy (CSP)
hash for the given script in the format expected by amp-script.
CSP is required when using amp-script with inline or cross-origin scripts.
Install via:
$ npm install @ampproject/toolbox-script-csp
The module exposes a single function, calculateHash(src, options?).
src can be either a string (in which case UTF8 encoding is assumed) or a
DataView
such as a Buffer.
options is used to override the default options.
algorithm overrides the hashing algorithm to use. Currently, the only
algorithm supported by amp-script is sha384 which is the default value.Here is an example on how to use the calculateHash function to generate an
amp-script CSP header.
Note that both leading and trailing whitespace is included in calculating the hash and must exactly match the whitespace used in the inline script.
const {calculateHash} = require('@ampproject/toolbox-script-csp');
const script = `
const subject = 'world';
console.log('Hello, ' + subject);
`;
const hash = calculateHash(script);
console.log(hash); // sha384-xRxb5sv13at6tVgZET4JLmf89TSZP10HjCGXVqO9bKWVXB0asV2jLrsDN8v4zX6j
The generated hash can be used in a <meta> tag this way:
<!doctype html>
<html ⚡>
<head>
...
<meta name="amp-script-src" content="sha384-xRxb5sv13at6tVgZET4JLmf89TSZP10HjCGXVqO9bKWVXB0asV2jLrsDN8v4zX6j">
</head>
<body>
...
<amp-script layout="container" script="example"></amp-script>
<script id="example" type="text/plain" target="amp-script">
const subject = 'world';
console.log('Hello, ' + subject);
</script>
</body>
</html>
FAQs
A library that calculates the CSP hash for amp-script
The npm package @ampproject/toolbox-script-csp receives a total of 33,016 weekly downloads. As such, @ampproject/toolbox-script-csp popularity was classified as popular.
We found that @ampproject/toolbox-script-csp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 16 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A developer is accusing Tencent of violating the GPL by modifying a Python utility and changing its license to BSD, highlighting the importance of copyleft compliance.
Security News
In an open letter, JavaScript community leaders urge Oracle to give up the JavaScript trademark, arguing that it has been effectively abandoned through nonuse.
Security News
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.