yesod-middleware-csp: A middleware for building CSP headers on the fly

[ library, mit, web, yesod ] [ Propose Tags ] [ Report a vulnerability ]

Deals with CSP without disabling it. This is done by overriding the default yesod provided addScript functionalities and adding a nonce to the tag, and the right headers to the request.


[Skip to Readme]

Modules

[Last Documentation]

  • Yesod
    • Middleware
      • Yesod.Middleware.CSP

Downloads

Maintainer's Corner

Package maintainers

For package maintainers and hackage trustees

Candidates

Versions [RSS] 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.2.0, 1.3.0
Change log changelog.md
Dependencies base (>=4.14 && <5), base64-bytestring (>=1.0.0 && <1.3), bytestring (>=0.10 && <0.13), conduit (>=1.3.1 && <1.4), containers (>=0.6 && <0.8), directory (>=1.3.3 && <1.4), filepath (>=1.4.2 && <1.6), http-client (>=0.6.4 && <0.8), network-uri (>=2.6.1 && <2.7), template-haskell (>=2.14 && <2.23), text (>=1.2.3 && <2.2), time (>=1.8 && <1.13), uuid (>=1.3.13 && <1.4), yesod (>=1.6.0 && <1.7), yesod-core (>=1.6.16 && <1.7), yesod-static (>=1.6 && <1.7) [details]
Tested with ghc ==9.10.3
License MIT
Author Jezen Thomas <jezen@supercede.com>
Maintainer Jezen Thomas <jezen@supercede.com>
Uploaded by Valeri at 2026-04-29T12:24:14Z
Category Web, Yesod
Home page https://github.com/SupercedeTech/yesod-middleware-csp
Bug tracker https://github.com/SupercedeTech/yesod-middleware-csp/issues
Source repo head: git clone https://github.com/SupercedeTech/yesod-middleware-csp.git
Distributions
Downloads 552 total (15 in the last 30 days)
Rating (no votes yet) [estimated by Bayesian average]
Your Rating
  • λ
  • λ
  • λ
Status Docs not available [build log]
All reported builds failed as of 2026-04-29 [all 2 reports]

Readme for yesod-middleware-csp-1.3.0

[back to package description]

yesod-middleware-csp

A middleware for building CSP headers on the fly

Deals with CSP without disabling it. This is done by overriding the default yesod provided addScript functionalities and adding a nonce to the tag, and the right headers to the request.

Usage

Because there is no good way of enforcing CSP at typelevel in yesod, it's best to hide the addScript functions from yesod with the ones provided by this library:

import Yesod hiding (addScript, addScriptRemote)
import Yesod.Middleware.CSP (addScript, addScriptRemote, addCSPMiddleware)

Then wire up the middleware in your Yesod instance:

instance Yesod App where
  yesodMiddleware = addCSPMiddleware

How to run tests

nix build

Contributing

PR's are welcome.