Registry / auth-security / content-security-policy

content-security-policy

library0.2.3jsnpmunverified

Express/Connect middleware for setting Content-Security-Policy HTTP headers according to the W3C CSP specification (v0.3.4). This library provides helper constants (SRC_NONE, SRC_SELF, SRC_DATA) and a convenient getCSP() function to generate middleware for global or route-specific policies. It is minimal and focused solely on CSP headers, unlike more comprehensive security packages such as helmet (which includes CSP as one of many middleware). The package requires Node >= 0.4.0 and has no external dependencies, making it lightweight and easy to integrate into existing Express applications. The API is stable but the package has not seen updates since 2018; consider evaluating its suitability for modern CSP requirements.

auth-security http-networking web-framework

npm install content-security-policy

github ↗package ↗

INSTALL

IMPORT

SIG · CONTENT-SECURITY-P

content-security-policy

auth-securityjavascriptv0.2.3

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

csp

✓ const csp = require('content-security-policy');

✗ import csp from 'content-security-policy';

This package does not ship ESM; use CommonJS require() or a dynamic import().

SRC_NONE

✓ const { SRC_NONE } = require('content-security-policy');

✗ import { SRC_NONE } from 'content-security-policy';

Named exports are not available as ESM; destructure from require.

getCSP

✓ const { getCSP } = require('content-security-policy');

✗ const getCSP = require('content-security-policy').getCSP;

Both patterns work in CJS, but destructuring is preferred.

Express app using content-security-policy middleware: global policy from STARTER_OPTIONS, custom policy for a specific route.

const csp = require('content-security-policy'); const express = require('express'); const app = express(); const policy = { 'default-src': csp.SRC_NONE, 'script-src': [csp.SRC_SELF], 'report-uri': '/csp-report' }; app.use(csp.getCSP(csp.STARTER_OPTIONS)); app.get('/secure', csp.getCSP(policy), (req, res) => { res.send('This route has CSP enforced.'); }); app.listen(3000);

Debug

Known issues

gotchaCSP policy values must be strings or arrays of strings; using objects will be ignored.

fix

Ensure every directive value is a valid source expression string, e.g., 'self' not SRC_SELF directly.

affects: >=0.0.0

gotchaThe middleware does not set CSP via a meta tag; it only sets the HTTP header.

fix

If you need CSP in HTML, consider a different approach or add meta tag manually.

affects: >=0.0.0

deprecatedSTARTER_OPTIONS is not documented and may be removed; prefer defining a custom default policy.

fix

Define your own baseline policy instead of relying on STARTER_OPTIONS.

affects: >=0.3.0

Errors

Common errors & fixes

TypeError: csp.getCSP is not a function

Importing default export instead of named function when using ESM syntax.

fix

Use const { getCSP } = require('content-security-policy'); or use dynamic import().

Error: Cannot find module 'content-security-policy'

Package not installed or incorrect import path.

fix

Run `npm install content-security-policy --save` and ensure require path is correct.

Upgrade

Version history

0.2.3latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

15 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/samuelerdtman/content-security-policy ↗

packagehttps://www.npmjs.com/package/content-security-policy ↗