CSP and headers
If your site sends a Content-Security-Policy#
Allow the loader origin to supply scripts and the bundle origins to be fetched:
script-src https://cdn.example;
connect-src https://cdn.example https://cdn-a.example https://cdn-b.example;Merge these into your existing policy; do not replace it. The loader inserts no inline script. Whether the switcher needs style-src 'unsafe-inline' depends on the switcher version and is verify; prefer a stylesheet link or a nonce.
If a policy blocks a request, the loader treats it as a network failure and the page stays in the source language.
Subresource Integrity#
<script src="https://cdn.example/loader/1.4.2/loader.js" integrity="sha384-..." crossorigin="anonymous" async
data-site-key="rl_site_live_..." data-public-key="..."></script>Use it only with an immutable, versioned loader URL. The CDN must send Access-Control-Allow-Origin: * on the file, or the browser blocks the script. Version 1.4.2 is an illustration, not a release.
Delivery-plane response headers (design)#
| Header | Value |
|---|---|
Access-Control-Allow-Origin | * (public files, never credentials) |
X-Content-Type-Options | nosniff |
Content-Type | application/json; charset=utf-8; loader text/javascript; charset=utf-8 |
Cross-Origin-Resource-Policy | cross-origin |
Content-Security-Policy | default-src 'none'; sandbox on JSON responses |
Set-Cookie | never |
CDN providers may add cookies or headers by default; checking each provider is verify.
Static hosts#
Netlify (_headers or netlify.toml), Cloudflare Pages (_headers, 100 rules, static responses only) and Vercel (vercel.json headers) let you set headers, including a CSP. GitHub Pages documents no header or CSP control (undocumented is not the same as unsupported: verify). On Astro, security.csp (from 6.0, off by default) writes hashes into a meta tag and external scripts need explicit allowance; SvelteKit prerendered pages get hash policies as a meta tag and an external script goes in directives.script-src. On Magento payment pages and BigCommerce checkout pages, scripts need a whitelist entry or an integrity hash (see the script snippet).