Generates a Content Security Policy string.
Defaults are the strictest useful policy: no inline styles, no unrestricted HTTPS images. Opt into either via CSPOptions.allowInlineStyles / CSPOptions.allowAnyHttpsImages if your webview genuinely needs them.
Supplying a nonce makes script-src the nonce alone. Every script tag then needs the matching nonce attribute — createWebviewHtml adds it for the scripts it renders.
nonce
script-src
The webview for cspSource
CSP options
CSP meta tag content
const nonce = generateNonce();const csp = generateCSP(webview, { nonce, mediaSrc: [webview.cspSource] });// Use in HTML: <meta http-equiv="Content-Security-Policy" content="${csp}"> Copy
const nonce = generateNonce();const csp = generateCSP(webview, { nonce, mediaSrc: [webview.cspSource] });// Use in HTML: <meta http-equiv="Content-Security-Policy" content="${csp}">
Generates a Content Security Policy string.
Defaults are the strictest useful policy: no inline styles, no unrestricted HTTPS images. Opt into either via CSPOptions.allowInlineStyles / CSPOptions.allowAnyHttpsImages if your webview genuinely needs them.
Supplying a
noncemakesscript-srcthe nonce alone. Every script tag then needs the matchingnonceattribute — createWebviewHtml adds it for the scripts it renders.