sec-csp-generate Edge Function — Security

sec-csp-generate — Build Content-Security-Policy headers

Converts a structured CSP directives object into a ready-to-use Content-Security-Policy header string. Supports report-only mode and violation reporting endpoints.

---

API

POST /api/sec-csp-generate

Request body

Field	Type	Required	Default	Description
directives	Record<string, string[]>	✅	—	CSP directive names mapped to arrays of source values
reportUri	string	❌	—	URL for CSP violation reports
reportOnly	boolean	❌	false	Use report-only mode (no blocking)

Success response (200)

{
  "success": true,
  "data": {
    "header": "default-src 'self'; script-src 'self' https://cdn.example.com",
    "headerName": "Content-Security-Policy"
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing or invalid directives
INTERNAL_ERROR	500	Unexpected error

---

Usage

cURL

curl -X POST "$FUNCTION_URL" \
  -H "Content-Type: application/json" \
  -d '{
    "directives": {
      "default-src": ["'\''self'\''"],
      "script-src": ["'\''self'\''", "https://cdn.example.com"],
      "img-src": ["*"]
    }
  }'

TypeScript / JavaScript (HTTP)

const response = await fetch(FUNCTION_URL, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    directives: {
      'default-src': ["'self'"],
      'script-src': ["'self'", 'https://cdn.example.com'],
      'object-src': ["'none'"],
    },
    reportUri: 'https://csp.report/my-project',
  }),
});
const { data } = await response.json();
res.setHeader(data.headerName, data.header);

Direct import (Node / Bun / Deno)

import { generateCsp } from '@aerostack/functions/sec-csp-generate';

const { header, headerName } = generateCsp({
  directives: {
    'default-src': ["'self'"],
    'script-src': ["'self'", 'https://cdn.example.com'],
  },
});
response.headers.set(headerName, header);

---

Use Cases

• Generating CSP headers dynamically per-tenant based on their configured CDN/script sources
• Validating a CSP configuration before deploying it (use report-only first)
• Building a CSP middleware factory that reads from config and sets headers on every response
• Generating environment-specific CSP headers (stricter in production, looser in dev)

---

Notes

• Directive names are lowercased automatically
• Flag directives (no values) like upgrade-insecure-requests — pass an empty array []
• Common source values: 'self', 'none', 'unsafe-inline', 'unsafe-eval', https:, data:
• The report-only mode is useful for testing a new policy without breaking anything