From 0d654585522b550b68f7c28d5501dd8411f11edc Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Fri, 21 Nov 2025 16:29:02 -0600 Subject: [PATCH] Improve CSP example formatting and clarity in apps specification MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Change CSP code block from yaml to typescript fence, add context showing where csp variable originates (resource.\_meta?.ui?.csp), rename cspHeader to cspValue for accuracy, and remove Content-Security-Policy: prefix since the variable holds just the policy value, not a complete HTTP header. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- specification/draft/apps.mdx | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/specification/draft/apps.mdx b/specification/draft/apps.mdx index b257256..7701afa 100644 --- a/specification/draft/apps.mdx +++ b/specification/draft/apps.mdx @@ -1044,17 +1044,20 @@ Hosts MUST enforce Content Security Policies based on resource metadata. **CSP Construction from Metadata:** -```yaml -Content-Security-Policy: +```typescript +const csp = resource._meta?.ui?.csp; + +const cspValue = ` default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; - connect-src 'self' ${csp.connect_domains?.join(' ') || ''}; - img-src 'self' data: ${csp.resource_domains?.join(' ') || ''}; - font-src 'self' ${csp.resource_domains?.join(' ') || ''}; + connect-src 'self' ${csp?.connect_domains?.join(' ') || ''}; + img-src 'self' data: ${csp?.resource_domains?.join(' ') || ''}; + font-src 'self' ${csp?.resource_domains?.join(' ') || ''}; frame-src 'none'; object-src 'none'; base-uri 'self'; +`; ``` **Security Requirements:**