CSP and script contents
A meta Content-Security-Policy without 'unsafe-inline' turns every inline script into a warning. The import map has an unknown key, and the speculation rule gives urls as a string.
CSP and script contents
examples/showcase/csp-and-scripts.html<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
<title>CSP and scripts</title>
<script type="importmap">{ "imports": { "app": "./app.js" }, "scope": {} }</script>
</head>
<body>
<script>document.body.classList.add("js");</script>
<script type="speculationrules">{ "prerender": [{ "source": "list", "urls": "/next/" }] }</script>
</body>
</html>error 7:3 scripts.import-map A "script" element with a "type" attribute whose value is "importmap" must contain a JSON object with no properties other than "imports", "scopes", and "integrity". error 11:3 scripts.speculation-rules The "urls" property in a speculation rule must be a JSON array. warning 7:3 csp.meta-enforcement Inline script violates Content Security Policy (meta tag): blocked by "script-src" directive (missing "'unsafe-inline'" or nonce/hash). warning 10:3 csp.meta-enforcement Inline script violates Content Security Policy (meta tag): blocked by "script-src" directive (missing "'unsafe-inline'" or nonce/hash). warning 11:3 csp.meta-enforcement Inline script violates Content Security Policy (meta tag): blocked by "script-src" directive (missing "'unsafe-inline'" or nonce/hash). 2 errors, 3 warnings