Skip to content

Support Content Security Policy (style-src) #1786

Closed

Description

@scottmizo

Which scope/s are relevant/related to the feature request?

astro-angular

Information

It appears that the astro-angular package does not currently work with the Astro CSP experimental feature. From what I can tell, the hash-sources for styles defined in the Angular component styles, styleUrl or stylesUrls properties are not being computed. This causes the browser not apply the inline styles associated with the component. This is also an issue with any modules imported into the component.

As per Astro CSP roadmap: When using client islands, Astro injects known styles (Astro island) and scripts (Astro island and directives). These assets are known at build time, so Astro calculates the hashes at build time and stores them in the manifest. The rendering engine will just read and render them.

I'm not even sure this is possible due to the way the Angular component is packaged but it would be great to be able to use the CSP feature.

Describe any alternatives/workarounds you're currently using

No response

I would be willing to submit a PR to fix this issue

  • Yes
  • No

Activity

  1. brandonroberts commented on Jun 26, 2025

    @brandonroberts
    Member

    You may be able to use Angular's providers for setting the CSP https://angular.dev/best-practices/security#content-security-policy

    At the component level, use the renderProviders to register the token

  2. locked and limited conversation to collaborators on Jun 26, 2025
  3. converted this issue into a discussion #1792 on Jun 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions