fast-twitch.middlewares.content-security-policy

Usage and execution boundary

Builds CSP from structured directives, validates/serializes the selected configuration and writes the configured header. The lower-level helpers are documented individually below. A nonce policy requires per-response nonce values and matching page markup.

(ns application.middleware
  (:require [fast-twitch.middlewares.content-security-policy :as middleware]))

(defn handler [_]
  {:status 200 :headers {"content-type" "text/plain"} :body "Hello"})

(def app (middleware/wrap-content-security-policy handler {:directives {"default-src" ["'self'"] "object-src" ["'none'"]}}))

This defines the Ring handler portion. Adapt app through routing/ft-handler or pass it to server/listen!; startup instructions and a complete walkthrough show the surrounding project.

Settings and defaults

Setting	Meaning
`:directives`	Map of directive names to source expressions in the config argument
`Options :header-name`	Optional header name; config and options are separate arguments

Wrapper order and all middleware families. The function reference below preserves the upstream signatures and source links; helper functions do not all share the wrapper's arity.

Upstream function reference

Applies Content Security Policy headers from structured directive data.

`append-unique-sources`

(append-unique-sources base extras)

Function.

Appends source expressions while preserving first occurrence order. Source

`apply-allow-origin-sources`

(apply-allow-origin-sources config input)

Function.

Applies a source input to the allowed-origin reflection list. Source

`apply-asset-base-urls`

(apply-asset-base-urls config asset-base-urls)

Function.

Adds asset base URLs to image/media sources and allowed-origin matching. Source

`apply-directive-sources`

(apply-directive-sources config directive input)

Function.

Applies a source input to one directive in a CSP config. Source

`build-csp-config`

(build-csp-config & inputs)

Function.

Applies structured CSP inputs to the default CSP configuration. Source

`build-csp-policy`

(build-csp-policy config)

Function.

Renders a CSP config into a Content-Security-Policy header value. Source

`content-security-policy-response`

(content-security-policy-response response request config)
(content-security-policy-response response request config options)

Function.

Adds CSP and optional reflected Access-Control-Allow-Origin headers. Source

`csp-directive`

(csp-directive directive sources)

Function.

Renders one CSP directive to a policy fragment. Source

`csp-directive-base-uri`

The base-uri CSP directive name. Source

`csp-directive-connect-src`

The connect-src CSP directive name. Source

`csp-directive-default-src`

The default-src CSP directive name. Source

`csp-directive-font-src`

The font-src CSP directive name. Source

`csp-directive-frame-src`

The frame-src CSP directive name. Source

`csp-directive-img-src`

The img-src CSP directive name. Source

`csp-directive-media-src`

The media-src CSP directive name. Source

`csp-directive-object-src`

The object-src CSP directive name. Source

`csp-directive-script-src`

The script-src CSP directive name. Source

`csp-directive-style-src`

The style-src CSP directive name. Source

`csp-directive-worker-src`

The worker-src CSP directive name. Source

`csp-source-blob`

The CSP source expression for blob: URLs. Source

`csp-source-data`

The CSP source expression for data: URLs. Source

`csp-source-fonts-googleapis`

The Google Fonts stylesheet source expression. Source

`csp-source-fonts-gstatic`

The Google Fonts asset source expression. Source

`csp-source-https`

The CSP source expression for all HTTPS origins. Source

`csp-source-jsdelivr`

The jsDelivr CDN source expression. Source

`csp-source-none`

The CSP source expression that blocks every source. Source

`csp-source-self`

The CSP source expression for the current origin. Source

`csp-source-unsafe-eval`

The CSP source expression that allows eval-like script execution. Source

`csp-source-unsafe-inline`

The CSP source expression that allows inline script or style content. Source

`csp-sources`

(csp-sources & sources)

Function.

Builds an append-mode source input for a directive. Source

`default-csp-config`

(default-csp-config)

Function.

Returns the shared baseline CSP configuration. Source

`default-directive-order`

The stable directive order used when rendering CSP policy strings. Source

`merge-csp-sources`

(merge-csp-sources base & extras)

Function.

Merges source expressions with normalization and duplicate removal. Source

`normalize-csp-sources`

(normalize-csp-sources sources)

Function.

Normalizes CSP source expressions while dropping blanks. Source

`origin-allowed?`

(origin-allowed? origin allowed-sources)

Function.

Returns true when an origin matches one of the configured allowed sources. Source

`origin-from-source`

(origin-from-source source)

Function.

Returns the URL origin for a CSP source expression when it has one. Source

`replace-csp-sources`

(replace-csp-sources & sources)

Function.

Builds a replace-mode source input for a directive. Source

`sanitize-exclusive-none-source`

(sanitize-exclusive-none-source sources)

Function.

Removes 'none' when a directive has other source expressions. Source

`update-csp-config`

(update-csp-config base & inputs)

Function.

Applies structured CSP inputs to a base config without mutating it. Source

`wrap-content-security-policy`

(wrap-content-security-policy handler)
(wrap-content-security-policy handler config)
(wrap-content-security-policy handler config options)

Function.

Wraps a handler so responses receive a structured Content Security Policy. Source