Add CSP for inline scripts, generate integrity hashes.

astro.config.mjs

@@ -1,16 +1,22 @@
+import { resolve } from 'node:path'
 import starlight from "@astrojs/starlight";
 import svelte from "@astrojs/svelte";
 import tailwind from "@astrojs/tailwind";
+import { shield } from '@kindspells/astro-shield'
 import { defineConfig, squooshImageService } from "astro/config";
 import blog from "starlight-blog";
 
+const rootDir = new URL('.', import.meta.url).pathname
+const modulePath = resolve(rootDir, 'src', 'generated', 'sriHashes.mjs')
+
 // https://astro.build/config
 export default defineConfig({
 	site: "https://www.waterfox.net",
 	image: {
 		service: squooshImageService(),
 	},
 	integrations: [
+		shield({}),
 		starlight({
 			components: {
 				Head: "~/components/Head.astro",

package.json

@@ -1,37 +1,38 @@
 {
-	"type": "module",
-	"scripts": {
-		"predev": "bun run src/utils/github.ts",
-		"dev": "astro dev",
-		"prestart": "bun run src/utils/github.ts",
-		"start": "astro dev",
-		"prebuild": "bun run src/utils/github.ts",
-		"build": "astro build",
-		"preview": "astro preview",
-		"astro": "astro",
-		"update": "bunx npm-check-updates --interactive --format group",
-		"format": "bunx @biomejs/biome check --apply *"
-	},
-	"dependencies": {
-		"@astrojs/starlight": "^0.21.5",
-		"@astrojs/starlight-tailwind": "^2.0.2",
-		"@astrojs/svelte": "^5.4.0",
-		"@astrojs/tailwind": "^5.1.0",
-		"@tailwindcss/typography": "^0.5.12",
-		"@vercel/og": "^0.6.2",
-		"astro": "^4.6.1",
-		"get-os-name": "^1.0.3",
-		"lodash": "^4.17.21",
-		"sass": "^1.75.0",
-		"sharp": "^0.33.3",
-		"starlight-blog": "^0.5.1",
-		"svelte": "^4.2.14",
-		"svelte-select": "^5.8.3",
-		"tailwind-merge": "^2.2.2",
-		"tailwindcss": "^3.4.3",
-		"tailwindcss-scoped-preflight": "^3.2.5"
-	},
-	"devDependencies": {
-		"@biomejs/biome": "1.7.0"
-	}
+  "type": "module",
+  "scripts": {
+    "predev": "bun run src/utils/github.ts",
+    "dev": "astro dev",
+    "prestart": "bun run src/utils/github.ts",
+    "start": "astro dev",
+    "prebuild": "bun run src/utils/github.ts",
+    "build": "astro build",
+    "preview": "astro preview",
+    "astro": "astro",
+    "update": "bunx npm-check-updates --interactive --format group",
+    "format": "bunx @biomejs/biome check --apply *"
+  },
+  "dependencies": {
+    "@astrojs/starlight": "^0.21.5",
+    "@astrojs/starlight-tailwind": "^2.0.2",
+    "@astrojs/svelte": "^5.4.0",
+    "@astrojs/tailwind": "^5.1.0",
+    "@kindspells/astro-shield": "^1.3.5",
+    "@tailwindcss/typography": "^0.5.12",
+    "@vercel/og": "^0.6.2",
+    "astro": "^4.6.1",
+    "get-os-name": "^1.0.3",
+    "lodash": "^4.17.21",
+    "sass": "^1.75.0",
+    "sharp": "^0.33.3",
+    "starlight-blog": "^0.5.1",
+    "svelte": "^4.2.14",
+    "svelte-select": "^5.8.3",
+    "tailwind-merge": "^2.2.2",
+    "tailwindcss": "^3.4.3",
+    "tailwindcss-scoped-preflight": "^3.2.5"
+  },
+  "devDependencies": {
+    "@biomejs/biome": "1.7.0"
+  }
 }

public/_headers

@@ -1,7 +1,7 @@
 https://www.waterfox.net/*
 Access-Control-Allow-Origin: https://www.waterfox.net
 Cache-Control: no-store, max-age=0
-Content-Security-Policy: upgrade-insecure-requests
+Content-Security-Policy: upgrade-insecure-requests; default-src 'self'; script-src https://www.waterfox.net
 Cross-Origin-Embedder-Policy: require-corp
 Cross-Origin-Opener-Policy: same-origin
 Cross-Origin-Resource-Policy: same-origin