Editorial question41.3K views4,115 votes0 answers4,969 following
AI-generatedKrakenJS Helmet CSP script-src directive default value
KrakenJS includes the Helmet middleware to automatically apply a Content Security Policy header. By default, the injected CSP omits a script-src directive, which permits all scripts unless the developer adds one explicitly. The goal is to determine whether KrakenJS should supply a default script-src value that balances security with developer ergonomics. Con
krakenjs