Content Security Policy Middleware

Build a Koa middleware that configures Content Security Policy (CSP) headers for a web application serving both static content and dynamic API responses.

Requirements

Your middleware should:

1. Set up a CSP that allows scripts only from the same origin and a trusted CDN at https://cdn.example.com
2. Allow images from any source
3. Allow styles from the same origin and inline styles
4. Block all object embeds (Flash, etc.)
5. Allow connections (fetch, XHR, WebSocket) to the same origin and an API at https://api.example.com
6. Set default source to 'self' only

Implementation

@generates

API

/**
 * Creates a Koa middleware that sets Content Security Policy headers.
 *
 * @returns {Function} Koa middleware function
 */
function createCSPMiddleware() {
  // IMPLEMENTATION HERE
}

module.exports = { createCSPMiddleware };

Test Cases

• The middleware sets a Content-Security-Policy header @test
• The CSP allows scripts from same origin and cdn.example.com @test
• The CSP allows images from any source @test
• The CSP blocks object embeds @test

Dependencies { .dependencies }

koa-helmet { .dependency }

Provides security header middleware for Koa applications, including Content Security Policy configuration.

@satisfied-by