Response-Header CSP for Client Sites

Response-Header CSP for Client Sites

Why AstroWEBTheme uses real Content-Security-Policy response headers with nonces instead of relying on meta-only policy tags.

By · Updated

AstroWEBTheme is designed around real response-header Content-Security-Policy for production sites.

Meta CSP can help in limited cases, but it is not a complete replacement for HTTP headers. Client sites need a policy that works across public pages, SSR routes, dashboards, API endpoints, and generated assets.

Theme Security Goals

The security model aims to:

  • avoid unsafe-inline
  • use per-request nonces for scripts that need them
  • load generated scripts through a manifest
  • keep analytics and ads consent-aware
  • support Turnstile-ready forms
  • keep admin responses no-store
  • work naturally on Cloudflare Workers or Pages

Where Configuration Lives

Security configuration is handled in:

  • src/site/config/security.mjs
  • src/site/config/functions.mjs
  • core/layouts/base.astro
  • core/components/FilesToLoadJS.astro
  • src/data/manifest/scripts.json

Generated Cloudflare config is managed by:

  • core/scripts/generate/wrangler-json.mjs
  • wrangler.jsonc

Why Agents Should Care

AI agents often add scripts, widgets, analytics, forms, and third-party services. Without a clear CSP model, those changes can silently weaken production security.

When an agent adds a script, it should:

  1. Check the existing script loader pattern.
  2. Prefer manifest-managed scripts.
  3. Preserve nonce handling.
  4. Update CSP allowlists only when needed.
  5. Avoid broad directives such as script-src *.
  6. Build and test after changes.

Analytics and ads should respect the consent banner. The theme separates markup, consent state, and lazy script loading so sites can keep a strict CSP while still supporting common business tooling.

Verification

After security changes, verify:

  • page HTML includes nonce attributes where expected
  • lazy scripts are promoted by the worker lazy loader
  • consent banner controls analytics and ads
  • production responses include CSP headers
  • no required script depends on unsafe-inline