mirror of
https://github.com/mintlify/docs.git
synced 2026-09-14 13:35:46 +08:00
Ethan Palm
017d7c7377
* fix: reduce Vale false positives via vocab and config updates - Make English-word vocab entries case-insensitive so sentence-start capitalization and normal prose usage stop flagging (agents, rest, cursor, setup, endpoints, etc.) - Add vocab entries for filenames and code identifiers that appear in frontmatter and JSX contexts (docs.json, llms.txt, CLAUDE.md, etc.) - Ignore openapi frontmatter lines, filenames, JSX attributes, email addresses, and internal link targets via TokenIgnores - Skip inline code scope and indented code fences - Add Headings exceptions for proper nouns (Claude Code, GitHub Actions, Route 53, GA4, etc.) - Disable linting for the all-code vercel-json-generator snippet Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: resolve all Vale warnings and errors across docs Content fixes: - Reword sentences using 'will', first person, spaced em dashes, 'e.g.', Latin abbreviations, and hyphenated adverbs - Sentence-case headings that started with dotted filenames - Backtick literal API values instead of bolding them - Move periods inside quotation marks - Fix Oxford comma rule misfires by restructuring sentences False-positive suppression: - Vale toggles around example user questions, keyboard shortcut keys (Cmd+I), UI labels, and code samples in JSX contexts that Vale misparses - Exclude vale toggle comments from the brace Token/BlockIgnores so in-document commands actually reach Vale (the greedy brace pattern was also silently swallowing large regions; now lazy) - Vocab entries for code identifiers (internal_id, handleSubmit, etc.) - Per-file rule disables for component docs with dotted JSX names and files where link-target linting ignores in-document toggles Result: vale --minAlertLevel warning is clean repo-wide; only suggestion-level items (Passive, Semicolons, Acronyms) remain. mint broken-links passes. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: correct WordList rule instead of degrading prose - Restore sentence-start "Email" in advanced-support; the rule now only flags hyphenated e-mail/E-mail forms - Restore the idiom "above all else"; the above->preceding swap now exempts "above all" Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: restore deliberate prose flagged by blunt rules - Restore spatial 'above the navbar' / 'above a page title' in custom-scripts; the above->preceding swap now exempts 'above the/a/an' - Restore the '= ...' in the react-components named-export example (the ellipsis is inside inline code) with an Ellipses toggle - Restore SLA phrasing 'will use commercially reasonable efforts' with a Will toggle - Restore the quoted developer question in the GEO guide intro with a FirstPerson toggle, matching the file's other example questions Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: remove WordList swaps that flag legitimate English - Drop tablet->device and firewalls->firewall rules; both words are correct in ordinary prose - Narrow touch->tap to UI-instruction phrasing (touch the/a) so 'keep in touch' and 'touch devices' stop flagging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: reposition vale toggles to wrap whole blocks Toggle comments placed between list items split the lists (restarting ol numbering in deployments) and comments flush against tables risked breaking GFM table parsing. Wrap entire lists/tables with blank-line separation instead. Verified rendering with mint dev: single ol with two items, tables intact, no comments in visible DOM. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor: prune accept.txt to load-bearing entries Empirically removed 166 vocab entries (575 -> 409) whose removal causes no Vale flags across all 908 English pages: dictionary words that never needed listing (agents, setup, endpoints, webhooks, yaml), lowercase entries the speller already accepts, and filename entries made redundant by inline vale toggles. Kept every case-enforcing entry (API, JSON, GitHub, ...) so casing policy is unchanged, plus entries that double as capitalization exceptions for headings (mcp, md, auth, cursor, txt). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Update ai/mintlify-mcp.mdx * Update api/agent/v2/create-agent-job.mdx * chore: alphabetize Headings exceptions and accept.txt Case-insensitive sort, ignoring the (?i) prefix; also drops a duplicate Scala entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: re-apply OxfordComma rewrite lost in branch merge Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: resolve Vale suggestions batch 1 (acronyms, semicolons, passive voice) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: resolve remaining Vale suggestions (passive voice batch 2) Rewrite ~90 passive constructions to active voice across deploy, guides, migration-services, and organize docs. Toggle the deliberate passive examples in the style-and-tone guide ('by zombies' test). Add axios/lodash vocab entries for a repositioned code example. vale . is now fully clean: 0 errors, 0 warnings, 0 suggestions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
143 lines
7.8 KiB
Plaintext
143 lines
7.8 KiB
Plaintext
---
|
|
title: "Content Security Policy (CSP) configuration"
|
|
sidebarTitle: "CSP configuration"
|
|
description: "Configure Content Security Policy headers to allow Mintlify resources while maintaining security for reverse proxies and strict network policies."
|
|
keywords: ["Content Security Policy", "CSP", "directives", "security headers", "firewall", "XSS prevention"]
|
|
---
|
|
|
|
Content Security Policy (CSP) is a security standard that helps prevent cross-site scripting (XSS) attacks by controlling which resources a web page can load. Mintlify serves a default CSP that protects most sites. If you host your documentation behind a reverse proxy or firewall that overwrites the default CSP, you may need to configure CSP headers for features to function properly.
|
|
|
|
## CSP directives
|
|
|
|
The following CSP directives control which resources a page can load:
|
|
|
|
- `script-src`: Controls which scripts can run
|
|
- `style-src`: Controls which stylesheets can load
|
|
- `font-src`: Controls which fonts can load
|
|
- `img-src`: Controls which images, icons, and logos can load
|
|
- `connect-src`: Controls which URLs can connect to for API calls and WebSocket connections
|
|
- `frame-src`: Controls which URLs can embed in frames or iframes
|
|
- `default-src`: Fallback for other directives when not explicitly set
|
|
|
|
## Domain allowlist
|
|
|
|
{/* vale Vale.Terms = NO */}
|
|
|
|
| Domain | Purpose | CSP directive | Required |
|
|
|:-------|:--------|:--------------|:-------|
|
|
| `d4tuoctqmanu0.cloudfront.net` | KaTeX CSS, fonts | `style-src`, `font-src` | Required |
|
|
| `*.mintlify.site` | Documentation content | `connect-src`, `frame-src` | Required |
|
|
| `*.mintlify.com` | Dashboard, API, analytics proxy | `connect-src` | Required |
|
|
| `leaves.mintlify.com` | Assistant API | `connect-src` | Required |
|
|
| `d3gk2c5xim1je2.cloudfront.net` | Icons, images, logos | `img-src` | Required |
|
|
| `d1ctpt7j8wusba.cloudfront.net` | Mint version and release files | `connect-src` | Required |
|
|
| `mintcdn.com` | Images, favicons | `img-src`, `connect-src` | Required |
|
|
| `*.mintcdn.com` | Images, favicons | `img-src`, `connect-src` | Required |
|
|
| `cdn.jsdelivr.net` | Emoji assets for OG images | `script-src`, `img-src` | Required |
|
|
| `mintlify.s3.us-west-1.amazonaws.com` | S3-hosted images | `img-src` | Required |
|
|
| `hcaptcha.com` | hCaptcha CAPTCHA verification | `script-src`, `frame-src`, `style-src`, `connect-src`, `unsafe-eval`, `unsafe-inline` | Required |
|
|
| `*.hcaptcha.com` | hCaptcha CAPTCHA verification | `script-src`, `frame-src`, `style-src`, `connect-src`, `unsafe-eval`, `unsafe-inline` | Required |
|
|
| `fonts.googleapis.com` | Google Fonts | `style-src`, `font-src` | Optional |
|
|
| `www.googletagmanager.com` | Google Analytics/Google Tag Manager (GTM) | `script-src`, `connect-src` | Optional |
|
|
| `cdn.segment.com` | Segment analytics | `script-src`, `connect-src` | Optional |
|
|
| `plausible.io` | Plausible analytics | `script-src`, `connect-src` | Optional |
|
|
| `us.posthog.com` | PostHog analytics | `connect-src` | Optional |
|
|
| `tag.clearbitscripts.com` | Clearbit tracking | `script-src` | Optional |
|
|
| `cdn.heapanalytics.com` | Heap analytics | `script-src` | Optional |
|
|
| `chat.cdn-plain.com` | Plain chat widget | `script-src` | Optional |
|
|
| `chat-assets.frontapp.com` | Front chat widget | `script-src` | Optional |
|
|
| `browser.sentry-cdn.com` | Sentry error tracking | `script-src`, `connect-src` | Optional |
|
|
| `js.sentry-cdn.com` | Sentry JavaScript SDK | `script-src` | Optional |
|
|
|
|
{/* vale Vale.Terms = YES */}
|
|
|
|
## Example CSP configuration
|
|
|
|
<Note>
|
|
Only include domains for services that you use. Remove any analytics domains that you have not configured for your documentation.
|
|
</Note>
|
|
|
|
```text wrap
|
|
Content-Security-Policy:
|
|
default-src 'self';
|
|
script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net www.googletagmanager.com cdn.segment.com plausible.io
|
|
us.posthog.com tag.clearbitscripts.com cdn.heapanalytics.com chat.cdn-plain.com chat-assets.frontapp.com
|
|
browser.sentry-cdn.com js.sentry-cdn.com hcaptcha.com *.hcaptcha.com;
|
|
style-src 'self' 'unsafe-inline' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com hcaptcha.com *.hcaptcha.com;
|
|
font-src 'self' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com;
|
|
img-src 'self' data: blob: d3gk2c5xim1je2.cloudfront.net mintcdn.com *.mintcdn.com cdn.jsdelivr.net mintlify.s3.us-west-1.amazonaws.com;
|
|
connect-src 'self' *.mintlify.site *.mintlify.com d1ctpt7j8wusba.cloudfront.net mintcdn.com *.mintcdn.com
|
|
www.googletagmanager.com cdn.segment.com plausible.io us.posthog.com browser.sentry-cdn.com hcaptcha.com *.hcaptcha.com;
|
|
frame-src 'self' *.mintlify.site hcaptcha.com *.hcaptcha.com;
|
|
```
|
|
|
|
## Common configurations by proxy type
|
|
|
|
Most reverse proxies support adding custom headers.
|
|
|
|
### Cloudflare configuration
|
|
|
|
Create a Response Header Transform Rule:
|
|
|
|
1. In your Cloudflare dashboard, go to **Rules > Overview**.
|
|
2. Click **Create rule > Response Header Transform Rule**.
|
|
3. Configure the rule:
|
|
- **Modify response header**: Set static
|
|
- **Header name**: `Content-Security-Policy`
|
|
- **Header value**:
|
|
```text wrap
|
|
default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net hcaptcha.com *.hcaptcha.com; style-src 'self' 'unsafe-inline' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com hcaptcha.com *.hcaptcha.com; font-src 'self' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com; img-src 'self' data: blob: d3gk2c5xim1je2.cloudfront.net mintcdn.com *.mintcdn.com cdn.jsdelivr.net mintlify.s3.us-west-1.amazonaws.com; connect-src 'self' *.mintlify.site *.mintlify.com d1ctpt7j8wusba.cloudfront.net mintcdn.com *.mintcdn.com hcaptcha.com *.hcaptcha.com; frame-src 'self' *.mintlify.site hcaptcha.com *.hcaptcha.com;
|
|
```
|
|
4. Deploy your rule.
|
|
|
|
### AWS CloudFront configuration
|
|
|
|
Add a response headers policy in CloudFront:
|
|
|
|
```json
|
|
{
|
|
"ResponseHeadersPolicy": {
|
|
"Name": "MintlifyCSP",
|
|
"Config": {
|
|
"SecurityHeadersConfig": {
|
|
"ContentSecurityPolicy": {
|
|
"ContentSecurityPolicy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net hcaptcha.com *.hcaptcha.com; style-src 'self' 'unsafe-inline' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com hcaptcha.com *.hcaptcha.com; font-src 'self' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com; img-src 'self' data: blob: d3gk2c5xim1je2.cloudfront.net mintcdn.com *.mintcdn.com cdn.jsdelivr.net mintlify.s3.us-west-1.amazonaws.com; connect-src 'self' *.mintlify.site *.mintlify.com d1ctpt7j8wusba.cloudfront.net mintcdn.com *.mintcdn.com hcaptcha.com *.hcaptcha.com; frame-src 'self' *.mintlify.site hcaptcha.com *.hcaptcha.com;",
|
|
"Override": true
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
```
|
|
|
|
### Vercel configuration
|
|
|
|
Add to your `vercel.json`:
|
|
|
|
```json
|
|
{
|
|
"headers": [
|
|
{
|
|
"source": "/(.*)",
|
|
"headers": [
|
|
{
|
|
"key": "Content-Security-Policy",
|
|
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' cdn.jsdelivr.net hcaptcha.com *.hcaptcha.com; style-src 'self' 'unsafe-inline' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com hcaptcha.com *.hcaptcha.com; font-src 'self' d4tuoctqmanu0.cloudfront.net fonts.googleapis.com; img-src 'self' data: blob: d3gk2c5xim1je2.cloudfront.net mintcdn.com *.mintcdn.com cdn.jsdelivr.net mintlify.s3.us-west-1.amazonaws.com; connect-src 'self' *.mintlify.site *.mintlify.com d1ctpt7j8wusba.cloudfront.net mintcdn.com *.mintcdn.com hcaptcha.com *.hcaptcha.com; frame-src 'self' *.mintlify.site hcaptcha.com *.hcaptcha.com;"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
Identify CSP violations in your browser console:
|
|
|
|
1. Open your browser's Developer Tools.
|
|
2. Go to the **Console** tab.
|
|
3. Look for errors starting with:
|
|
- `Content Security Policy: The page's settings blocked the loading of a resource`
|
|
- `Refused to load the script/stylesheet because it violates the following Content Security Policy directive`
|
|
- `Refused to connect to because it violates the following Content Security Policy directive`
|