Registry / web-framework / vite-plugin-csp

vite-plugin-csp

library1.1.2jsnpmunverified

A Vite plugin that generates Content Security Policy meta tags and HTTP headers (CSP, CSP Report-Only, Report-To, Referrer-Policy) from all sources in the final HTML. Current stable version is 1.1.2 (June 2022). Uses csp-typed-directives for typed CSP directives. Compatible with csp-html-webpack-plugin configuration. No official releases since 2022; project appears in maintenance mode. Key differentiators: automated policy generation from Vite build output, TypeScript support, and header validation.

web-framework auth-security devops

npm install vite-plugin-csp

github ↗package ↗

INSTALL

IMPORT

SIG · VITE-PLUGIN-CSP

vite-plugin-csp

web-frameworkjavascriptv1.1.2

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–223 runs

build_error

glibc

node 18–223 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

ViteCspPlugin

✓ import ViteCspPlugin from 'vite-plugin-csp'

✗ import { ViteCspPlugin } from 'vite-plugin-csp'

Default export; named export does not exist in published bundle.

ViteCspPlugin

✓ const ViteCspPlugin = require('vite-plugin-csp')

✗ const { ViteCspPlugin } = require('vite-plugin-csp')

CommonJS require works; destructuring will fail.

type CspOptions

✓ import type { CspOptions } from 'vite-plugin-csp'

Type is exported from types file; available for TypeScript users.

Demonstrates minimal Vite CSP plugin configuration with custom policies.

// vite.config.ts import { defineConfig } from 'vite'; import ViteCspPlugin from 'vite-plugin-csp'; export default defineConfig({ plugins: [ ViteCspPlugin({ policies: { 'script-src': ["'self'", 'https://apis.google.com'], 'style-src': ["'self'", "'unsafe-inline'"], }, hashEnabled: true, nonceEnabled: false, }), ], });

Debug

Known issues

gotchaRelative module paths are resolved relative to CWD, not the file location.

fix

Use absolute paths or resolve manually with path.resolve(__dirname, ...).

affects: >=1.0.0

gotchaNo SSR support (and thus no nonce support).

fix

Do not use in SSR environments; avoids nonce-based CSP.

affects: >=1.0.0

gotchaOnly script and style related directives are supported (except report-to).

fix

Add other directives manually if needed; plugin ignores them.

affects: >=1.0.0

gotchaNo parsing of JS embedded sources (requires framework-specific plugins).

fix

Manually include inline script hashes in policy.

affects: >=1.0.0

deprecatedProject has not been updated since June 2022; consider alternatives for active development.

fix

Evaluate vite-plugin-csp2 or other actively maintained CSP plugins.

affects: >=1.1.2

Errors

Common errors & fixes

Module "vite-plugin-csp" has no exported member 'ViteCspPlugin'.

Named import used for default export.

fix

Use import ViteCspPlugin from 'vite-plugin-csp' (no braces).

Cannot find module 'vite-plugin-csp' or its corresponding type declarations.

TypeScript may not resolve types if skipLibCheck is false and types are missing.

fix

Add "types": ["vite-plugin-csp"] in tsconfig or ensure moduleResolution is 'node'.

Error: The csp plugin only supports scripts and styles.

Used directive like 'img-src' which is not supported.

fix

Remove unsupported directives from policy; only 'script-src', 'style-src', and 'report-to' work.

Error: Nonce generation is not supported in server-side rendering.

Used nonceEnabled: true with SSR.

fix

Set nonceEnabled: false or avoid SSR.

Upgrade

Version history

1.1.2latest on npm

Audit

Dependencies

viterequiredpeer dependency

Agent activity

25 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/josh-hemphill/vite-plugin-csp ↗

packagehttps://www.npmjs.com/package/vite-plugin-csp ↗