Module csp 

Kernel spec §7.2: every HTML response carries the Content-Security-Policy. One layer over the whole router sets it, so a page cannot be added without it.

Constants

LOGO_POLICY

The policy of a hat’s logo (plan 4d-B2; the security review’s A9): it is served from this origin, so opened as a page it must still run nothing, load nothing and be framed nowhere, whatever it holds.

POLICY

Kernel spec §7.2’s policy. No page has an inline script, so it names no hash: the web UI’s theme bootstrap is a file of its own (/theme.js). Everything else comes from this origin: scripts, styles, fonts, API calls and form targets (plan 4b).

WORKER_POLICY

The worker can execute and fetch only from its own origin.

Functions

on_html

Set POLICY on a text/html response. Use as axum::middleware::map_response(csp::on_html), outermost.