feat: Add option to add CSP to the replay iframe #1766
Conversation
|
There was a problem hiding this comment.
Pull request overview
This PR attempts to add Content Security Policy (CSP) support to the replay iframe to allow users to tighten security by blocking images, videos, objects, iframes, and other content types.
Key Changes:
- Added optional
cspconfiguration parameter to theplayerConfigtype - Implemented CSP application logic in the
setupDommethod of the Replayer class
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| packages/rrweb/src/types.ts | Adds optional csp?: string property to playerConfig type definition |
| packages/rrweb/src/replay/index.ts | Implements CSP application by setting the csp attribute on the replay iframe element |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
KristianGrafana
force-pushed
the
add-csp-config-option
branch
from
ec2a859 to
4016cb3
Compare
|
Hi @KristianGrafana, thanks for this addition. Since the csp attribute is lacking some major browser support it would be good to document this so people who use it don't get a false sense of security. And in general it would be good to document this feature in the Guide.md and rrweb-player readme files |
2 participants
This PR adds support to add a Content-Security-Policy to the iframe. This is if users want to further tighten the security of the iframe by being able to block images, videos, objects, iframes and more.
Let me know if you have any questions!