内容安全策略 (CSP)

Tauri 限制了你的 HTML 页面的内容安全策略。这可以用来减少或防止常见的基于网页的漏洞影响，例如跨站脚本攻击 (XSS)。

🌐 Tauri restricts the Content Security Policy (CSP) of your HTML pages. This can be used to reduce or prevent impact of common web based vulnerabilities like cross-site-scripting (XSS).

本地脚本已被哈希，样式和外部脚本通过加密随机数引用，这可以防止未授权内容被加载。

🌐 Local scripts are hashed, styles and external scripts are referenced using a cryptographic nonce, which prevents unallowed content from being loaded.

CSP 保护仅在 Tauri 配置文件中设置时启用。你应该尽可能限制它，只允许 webview 从你信任的主机加载资源，最好是你拥有的主机。在编译时，Tauri 会自动将其随机数和哈希附加到相关的 CSP 属性中，以应用于打包的代码和资源，因此你只需要关注应用中特有的内容。

🌐 The CSP protection is only enabled if set on the Tauri configuration file. You should make it as restricted as possible, only allowing the webview to load assets from hosts you trust, and preferably own. At compile time, Tauri appends its nonces and hashes to the relevant CSP attributes automatically to bundled code and assets, so you only need to worry about what is unique to your application.

这是一个来自 api 的 Tauri 示例的 CSP 配置，但每个应用开发者都需要根据自己的应用需求进行调整。

🌐 This is an example CSP configuration taken from the api example of Tauri, but every application developer needs to tailor this to their own application needs.

  "csp": {
        "default-src": "'self' customprotocol: asset:",
        "connect-src": "ipc: http://ipc.localhost",
        "font-src": ["https://fonts.gstatic.com"],
        "img-src": "'self' asset: http://asset.localhost blob: data:",
        "style-src": "'unsafe-inline' 'self' https://fonts.googleapis.com"
      },

有关此保护的更多信息，请参见 script-src、style-src 和 [CSP 来源]。

🌐 See script-src, style-src and CSP Sources for more information about this protection.