Struct CspConfig 

pub struct CspConfig {
    pub enabled: bool,
    pub report_only: bool,
    pub strict_dynamic: bool,
    pub unsafe_eval: bool,
    pub img_src: Vec<String>,
    pub script_src: Vec<String>,
    pub style_src: Vec<String>,
    pub connect_src: Vec<String>,
    pub font_src: Vec<String>,
    pub worker_src: Vec<String>,
}

Content-Security-Policy tuning (Qwik-style per-request nonces + configurable directives).

In dev (RESUMA_DEV=1), CSP is off by default so tooling matches Qwik’s isDev skip. Set RESUMA_CSP_DEV=1 to enforce CSP while developing.

Fields

enabled: bool

Emit a Content-Security-Policy (or Report-Only) header on HTML responses.

report_only: bool

Use Content-Security-Policy-Report-Only instead of enforcing.

strict_dynamic: bool

Add 'strict-dynamic' to script-src when a nonce is present (modern browsers).

unsafe_eval: bool

Allow eval / new Function for the resumability runtime. Keep true unless you replace the client.

img_src: Vec<String>

Extra img-src origins (e.g. https://images.pexels.com).

script_src: Vec<String>

Extra script-src origins.

style_src: Vec<String>

Extra style-src / style-src-elem origins (in addition to Google Fonts).

connect_src: Vec<String>

Extra connect-src origins (APIs, analytics).

font_src: Vec<String>

Extra font-src origins.

worker_src: Vec<String>

worker-src allowlist (Web Workers / Worklets). Empty = omit directive.

Implementations

impl CspConfig

pub fn from_env() -> Self

pub fn disabled() -> Self

Permissive dev profile: CSP disabled (same idea as Qwik plugin@csp when isDev).

pub fn webgpu() -> Self

CSP preset for WebGPU ClientComponents (workers + blob images/textures).

GLTF/VRM loaders create blob: object URLs and fetch() them — that needs connect-src … blob: in addition to img-src / worker-src.

pub fn production( extra_img_src: impl IntoIterator<Item = impl Into<String>>, ) -> Self

Strict production profile with optional extra image hosts.

Trait Implementations

impl Clone for CspConfig

fn clone(&self) -> CspConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for CspConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for CspConfig

fn default() -> Self

Returns the “default value” for a type.