--- title: Content Security Policy description: Run c15t on an Astro site under a strict Content Security Policy, with a per-request nonce from your middleware or with Astro's own hash-based CSP, and allow the consent backend and vendors. group: frameworks lastModified: "2026-10-10T16:01:45+01:00" --- ## What c15t adds to the page A Content Security Policy for an Astro site with c15t has to allow these: |What|Where it comes from|Directive| |--|--|--| |The color-scheme script|Inline, in ``, with `colorScheme` `'system'` or `'dark'`|`script-src`| |The banner reveal script|Inline, after a banner on a prerendered page|`script-src`| |`