createContentSecurityPolicy

Create a [content security policy](/docs/custom-storefronts/hydrogen/content-security-policy) to secure your application. The default content security policy includes exclusions for cdn.shopify.com and a script nonce.

Example code

import {RemixServer} from '@remix-run/react';
import isbot from 'isbot';
import {renderToReadableStream} from 'react-dom/server';
import {createContentSecurityPolicy} from '@shopify/hydrogen';

export default async function handleRequest(
  request,
  responseStatusCode,
  responseHeaders,
  remixContext,
) {
  const {nonce, header, NonceProvider} = createContentSecurityPolicy({
    // pass a custom directive to load content from a third party domain
    styleSrc: [
      "'self'",
      'https://cdn.shopify.com',
      'https://some-custom-css.cdn',
    ],
  });
  const body = await renderToReadableStream(
    <NonceProvider>
      <RemixServer context={remixContext} url={request.url} />
    </NonceProvider>,
    {
      nonce,
      signal: request.signal,
      onError(error) {
        // eslint-disable-next-line no-console
        console.error(error);
        responseStatusCode = 500;
      },
    },
  );

  if (isbot(request.headers.get('user-agent'))) {
    await body.allReady;
  }

  responseHeaders.set('Content-Type', 'text/html');
  responseHeaders.set('Content-Security-Policy', header);

  return new Response(body, {
    headers: responseHeaders,
    status: responseStatusCode,
  });
}

import type {EntryContext} from '@shopify/remix-oxygen';
import {RemixServer} from '@remix-run/react';
import isbot from 'isbot';
import {renderToReadableStream} from 'react-dom/server';
import {createContentSecurityPolicy} from '@shopify/hydrogen';

export default async function handleRequest(
  request: Request,
  responseStatusCode: number,
  responseHeaders: Headers,
  remixContext: EntryContext,
) {
  const {nonce, header, NonceProvider} = createContentSecurityPolicy({
    // pass a custom directive to load content from a third party domain
    styleSrc: [
      "'self'",
      'https://cdn.shopify.com',
      'https://some-custom-css.cdn',
    ],
  });
  const body = await renderToReadableStream(
    <NonceProvider>
      <RemixServer context={remixContext} url={request.url} />
    </NonceProvider>,
    {
      nonce,
      signal: request.signal,
      onError(error) {
        // eslint-disable-next-line no-console
        console.error(error);
        responseStatusCode = 500;
      },
    },
  );

  if (isbot(request.headers.get('user-agent'))) {
    await body.allReady;
  }

  responseHeaders.set('Content-Type', 'text/html');
  responseHeaders.set('Content-Security-Policy', header);

  return new Response(body, {
    headers: responseHeaders,
    status: responseStatusCode,
  });
}

Props

CreateContentSecurityPolicyGeneratedType

Returns: ContentSecurityPolicy

Params:

props: CreateContentSecurityPolicy & ShopProp

export function createContentSecurityPolicy( props?: CreateContentSecurityPolicy & ShopProp, ): ContentSecurityPolicy { const nonce = generateNonce(); const header = createCSPHeader(nonce, props); const Provider = ({children}: {children: ReactNode}) => { return createElement(NonceProvider, {value: nonce}, children); }; return { nonce, header, NonceProvider: Provider, }; }

CreateContentSecurityPolicy

baseUri

blockAllMixedContent

childSrc

connectSrc

defaultSrc

fontSrc

formAction

frameAncestors

frameSrc

imgSrc

manifestSrc

mediaSrc

navigateTo

objectSrc

pluginTypes

prefetchSrc

reportTo

reportUri

sandbox

scriptSrc

scriptSrcElem

styleSrc

upgradeInsecureRequests

workerSrc

DirectiveValues

string[] | string | boolean

ShopProp

shop

Shop specific configurations

ShopifyDomains

checkoutDomain

The production shop checkout domain url.

storeDomain

The production shop domain url.

ContentSecurityPolicy

header

The content security policy header

nonce

A randomly generated nonce string that should be passed to any custom `script` element