From 24b2f20c047db15b7adceab084a4ea4a1a6e00d1 Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Thu, 24 Sep 2026 01:58:26 +0000 Subject: [PATCH 1/5] docs: document enforced default CSP on hosted docs --- deploy/csp-configuration.mdx | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/deploy/csp-configuration.mdx b/deploy/csp-configuration.mdx index d45dda99ac..c493f35114 100644 --- a/deploy/csp-configuration.mdx +++ b/deploy/csp-configuration.mdx @@ -2,10 +2,29 @@ title: "Content Security Policy (CSP) configuration" sidebarTitle: "CSP configuration" description: "Configure Content Security Policy headers to allow Mintlify resources while maintaining security for reverse proxies and strict network policies." -keywords: ["Content Security Policy", "CSP", "directives", "security headers", "firewall", "XSS prevention"] +keywords: ["Content Security Policy", "CSP", "default CSP", "directives", "security headers", "firewall", "XSS prevention", "blocked resources"] --- -Content Security Policy (CSP) is a security standard that helps prevent cross-site scripting (XSS) attacks by controlling which resources a web page can load. Mintlify serves a default CSP that protects most sites. If you host your documentation behind a reverse proxy or firewall that overwrites the default CSP, you may need to configure CSP headers for features to function properly. +Content Security Policy (CSP) is a security standard that helps prevent cross-site scripting (XSS) attacks by controlling which resources a web page can load. Mintlify enforces a default CSP on every hosted documentation site. If you host your documentation behind a reverse proxy or firewall that overwrites the default CSP, you may need to configure CSP headers for features to function properly. + +## Default CSP + +Mintlify sends the following policy in the `Content-Security-Policy` header of every page on hosted documentation sites: + +```text wrap +default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; media-src 'self' data: blob: https:; frame-src 'self' blob: https:; connect-src 'self' data: https: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; upgrade-insecure-requests; +``` + +The header also includes `frame-ancestors` and `form-action` directives that control where your site can be embedded and where forms can submit. + +The default policy allows resources from any HTTPS origin, so most custom scripts, embeds, fonts, and analytics tools work without changes. Browsers block resources that the policy does not allow: + +- **HTTP resources:** Scripts, styles, fonts, and other resources must load over HTTPS. Connections to plain HTTP URLs, including local development servers such as `http://localhost:8545`, are blocked. +- **Blob and data scripts:** Scripts loaded from `blob:` or `data:` URLs are blocked. Some third-party tag loaders use this pattern. +- **Plugins:** `` and `` elements are blocked. +- **Cross-origin workers:** Web workers must load from your documentation domain or a `blob:` URL. + +If a custom script or integration stops working, check your browser console for CSP violations. See [Troubleshooting](#troubleshooting). Load the resource over HTTPS, or use a loader that doesn't rely on `blob:` scripts. ## CSP directives From 7c8142a728e9bdf27fce0395119dd56982312c5c Mon Sep 17 00:00:00 2001 From: "mintlify[bot]" <109931778+mintlify[bot]@users.noreply.github.com> Date: Thu, 24 Sep 2026 01:59:59 +0000 Subject: [PATCH 2/5] docs: translate default CSP section and apply style fixes --- deploy/csp-configuration.mdx | 6 +++--- es/deploy/csp-configuration.mdx | 25 +++++++++++++++++++++++-- fr/deploy/csp-configuration.mdx | 25 +++++++++++++++++++++++-- zh/deploy/csp-configuration.mdx | 25 +++++++++++++++++++++++-- 4 files changed, 72 insertions(+), 9 deletions(-) diff --git a/deploy/csp-configuration.mdx b/deploy/csp-configuration.mdx index c493f35114..81c8e634ba 100644 --- a/deploy/csp-configuration.mdx +++ b/deploy/csp-configuration.mdx @@ -19,9 +19,9 @@ The header also includes `frame-ancestors` and `form-action` directives that con The default policy allows resources from any HTTPS origin, so most custom scripts, embeds, fonts, and analytics tools work without changes. Browsers block resources that the policy does not allow: -- **HTTP resources:** Scripts, styles, fonts, and other resources must load over HTTPS. Connections to plain HTTP URLs, including local development servers such as `http://localhost:8545`, are blocked. -- **Blob and data scripts:** Scripts loaded from `blob:` or `data:` URLs are blocked. Some third-party tag loaders use this pattern. -- **Plugins:** `` and `` elements are blocked. +- **HTTP resources:** Scripts, styles, fonts, and other resources must load over HTTPS. Browsers block connections to plain HTTP URLs, including local development servers such as `http://localhost:8545`. +- **Blob and data scripts:** Browsers block scripts loaded from `blob:` or `data:` URLs. Some third-party tag loaders use this pattern. +- **Plugins:** Browsers block `` and `` elements. - **Cross-origin workers:** Web workers must load from your documentation domain or a `blob:` URL. If a custom script or integration stops working, check your browser console for CSP violations. See [Troubleshooting](#troubleshooting). Load the resource over HTTPS, or use a loader that doesn't rely on `blob:` scripts. diff --git a/es/deploy/csp-configuration.mdx b/es/deploy/csp-configuration.mdx index ef94ae42a4..0ab3ba809b 100644 --- a/es/deploy/csp-configuration.mdx +++ b/es/deploy/csp-configuration.mdx @@ -2,10 +2,31 @@ title: "Configuración de Content Security Policy (CSP)" sidebarTitle: "Configuración de CSP" description: "Configura encabezados de Content Security Policy para permitir recursos de Mintlify manteniendo la seguridad en proxies inversos y redes estrictas." -keywords: ["Content Security Policy", "CSP", "directivas", "encabezados de seguridad", "cortafuegos", "prevención de XSS"] +keywords: ["Content Security Policy", "CSP", "CSP predeterminada", "directivas", "encabezados de seguridad", "cortafuegos", "prevención de XSS", "recursos bloqueados"] --- -Content Security Policy (CSP) es un estándar de seguridad que ayuda a prevenir ataques de cross-site scripting (XSS) controlando qué recursos puede cargar una página web. Mintlify proporciona una CSP predeterminada que protege a la mayoría de los sitios. Si alojas tu documentación detrás de un proxy inverso o un cortafuegos que sobrescribe la CSP predeterminada, puede que necesites configurar encabezados CSP para que las funciones se ejecuten correctamente. +Content Security Policy (CSP) es un estándar de seguridad que ayuda a prevenir ataques de cross-site scripting (XSS) controlando qué recursos puede cargar una página web. Mintlify aplica una CSP predeterminada en todos los sitios de documentación alojados. Si alojas tu documentación detrás de un proxy inverso o un cortafuegos que sobrescribe la CSP predeterminada, puede que necesites configurar encabezados CSP para que las funciones se ejecuten correctamente. + +
+ ## CSP predeterminada +
+ +Mintlify envía la siguiente política en el encabezado `Content-Security-Policy` de cada página de los sitios de documentación alojados: + +```text wrap +default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; media-src 'self' data: blob: https:; frame-src 'self' blob: https:; connect-src 'self' data: https: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; upgrade-insecure-requests; +``` + +El encabezado también incluye las directivas `frame-ancestors` y `form-action`, que controlan dónde se puede incrustar tu sitio y a dónde pueden enviarse los formularios. + +La política predeterminada permite recursos de cualquier origen HTTPS, por lo que la mayoría de los scripts personalizados, elementos incrustados, fuentes y herramientas de analítica funcionan sin cambios. Los navegadores bloquean los recursos que la política no permite: + +- **Recursos HTTP:** Los scripts, estilos, fuentes y otros recursos deben cargarse a través de HTTPS. Los navegadores bloquean las conexiones a URL HTTP sin cifrar, incluidos los servidores de desarrollo locales como `http://localhost:8545`. +- **Scripts blob y data:** Los navegadores bloquean los scripts cargados desde URL `blob:` o `data:`. Algunos cargadores de etiquetas de terceros usan este patrón. +- **Plugins:** Los navegadores bloquean los elementos `` y ``. +- **Workers de origen cruzado:** Los web workers deben cargarse desde tu dominio de documentación o desde una URL `blob:`. + +Si un script personalizado o una integración deja de funcionar, revisa la consola de tu navegador para detectar infracciones de CSP. Consulta [Solución de problemas](#troubleshooting). Carga el recurso a través de HTTPS o usa un cargador que no dependa de scripts `blob:`.
## Directivas CSP diff --git a/fr/deploy/csp-configuration.mdx b/fr/deploy/csp-configuration.mdx index 9d9ffbfc5b..44301c99ab 100644 --- a/fr/deploy/csp-configuration.mdx +++ b/fr/deploy/csp-configuration.mdx @@ -2,10 +2,31 @@ title: "Configuration de la Content Security Policy (CSP)" sidebarTitle: "Configuration CSP" description: "Configurez les en-têtes Content Security Policy pour autoriser les ressources Mintlify tout en gardant la sécurité des proxys et des réseaux stricts." -keywords: ["Content Security Policy", "CSP", "directives", "en-têtes de sécurité", "pare-feu", "prévention XSS"] +keywords: ["Content Security Policy", "CSP", "CSP par défaut", "directives", "en-têtes de sécurité", "pare-feu", "prévention XSS", "ressources bloquées"] --- -La Content Security Policy (CSP) est une norme de sécurité qui aide à prévenir les attaques de cross-site scripting (XSS) en contrôlant les ressources qu’une page web est autorisée à charger. Mintlify fournit une CSP par défaut qui protège la plupart des sites. Si vous hébergez votre documentation derrière un reverse proxy ou un pare-feu qui remplace la CSP par défaut, vous devrez peut-être configurer les en-têtes CSP pour que certaines fonctionnalités fonctionnent correctement. +La Content Security Policy (CSP) est une norme de sécurité qui aide à prévenir les attaques de cross-site scripting (XSS) en contrôlant les ressources qu’une page web est autorisée à charger. Mintlify applique une CSP par défaut sur tous les sites de documentation hébergés. Si vous hébergez votre documentation derrière un reverse proxy ou un pare-feu qui remplace la CSP par défaut, vous devrez peut-être configurer les en-têtes CSP pour que certaines fonctionnalités fonctionnent correctement. + +
+ ## CSP par défaut +
+ +Mintlify envoie la politique suivante dans l’en-tête `Content-Security-Policy` de chaque page des sites de documentation hébergés : + +```text wrap +default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; media-src 'self' data: blob: https:; frame-src 'self' blob: https:; connect-src 'self' data: https: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; upgrade-insecure-requests; +``` + +L’en-tête inclut également les directives `frame-ancestors` et `form-action`, qui contrôlent où votre site peut être intégré et vers où les formulaires peuvent être envoyés. + +La politique par défaut autorise les ressources de n’importe quelle origine HTTPS, de sorte que la plupart des scripts personnalisés, contenus intégrés, polices et outils d’analytics fonctionnent sans modification. Les navigateurs bloquent les ressources que la politique n’autorise pas : + +- **Ressources HTTP :** les scripts, styles, polices et autres ressources doivent être chargés via HTTPS. Les navigateurs bloquent les connexions vers des URL HTTP non chiffrées, y compris les serveurs de développement locaux tels que `http://localhost:8545`. +- **Scripts blob et data :** les navigateurs bloquent les scripts chargés depuis des URL `blob:` ou `data:`. Certains chargeurs de balises tiers utilisent ce procédé. +- **Plugins :** les navigateurs bloquent les éléments `` et ``. +- **Workers cross-origin :** les web workers doivent être chargés depuis votre domaine de documentation ou depuis une URL `blob:`. + +Si un script personnalisé ou une intégration cesse de fonctionner, recherchez les violations CSP dans la console de votre navigateur. Consultez [Dépannage](#troubleshooting). Chargez la ressource via HTTPS ou utilisez un chargeur qui ne dépend pas de scripts `blob:`.
## Directives CSP diff --git a/zh/deploy/csp-configuration.mdx b/zh/deploy/csp-configuration.mdx index 3b5a006646..549812448f 100644 --- a/zh/deploy/csp-configuration.mdx +++ b/zh/deploy/csp-configuration.mdx @@ -2,10 +2,31 @@ title: "内容安全策略（CSP）配置" sidebarTitle: "CSP 配置" description: "配置内容安全策略标头，在允许 Mintlify 资源的同时，为反向代理和严格网络策略维护安全性。" -keywords: ["内容安全策略", "CSP", "指令", "安全标头", "防火墙", "XSS 防护"] +keywords: ["内容安全策略", "CSP", "默认 CSP", "指令", "安全标头", "防火墙", "XSS 防护", "被阻止的资源"] --- -内容安全策略（CSP）是一项安全标准，通过控制网页可加载的资源来帮助防止跨站脚本（XSS）攻击。Mintlify 提供了默认的 CSP，可保护大多数站点。如果你在反向代理或防火墙后托管文档，并覆盖了默认的 CSP，则可能需要配置 CSP 标头以确保各项功能正常运行。 +内容安全策略（CSP）是一项安全标准，通过控制网页可加载的资源来帮助防止跨站脚本（XSS）攻击。Mintlify 会在所有托管的文档站点上强制执行默认 CSP。如果你在反向代理或防火墙后托管文档，并覆盖了默认的 CSP，则可能需要配置 CSP 标头以确保各项功能正常运行。 + +
+ ## 默认 CSP +
+ +Mintlify 会在托管文档站点每个页面的 `Content-Security-Policy` 标头中发送以下策略： + +```text wrap +default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; media-src 'self' data: blob: https:; frame-src 'self' blob: https:; connect-src 'self' data: https: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; upgrade-insecure-requests; +``` + +该标头还包含 `frame-ancestors` 和 `form-action` 指令，用于控制你的站点可以被嵌入到哪里，以及表单可以提交到哪里。 + +默认策略允许来自任意 HTTPS 源的资源，因此大多数自定义脚本、嵌入内容、字体和分析工具无需更改即可正常工作。浏览器会阻止策略不允许的资源： + +- **HTTP 资源：** 脚本、样式、字体和其他资源必须通过 HTTPS 加载。浏览器会阻止到明文 HTTP URL 的连接，包括 `http://localhost:8545` 等本地开发服务器。 +- **blob 和 data 脚本：** 浏览器会阻止从 `blob:` 或 `data:` URL 加载的脚本。一些第三方标签加载器会使用这种方式。 +- **插件：** 浏览器会阻止 `` 和 `` 元素。 +- **跨源 worker：** Web worker 必须从你的文档域名或 `blob:` URL 加载。 + +如果自定义脚本或集成停止工作，请在浏览器控制台中检查 CSP 违规。请参阅[故障排除](#troubleshooting)。通过 HTTPS 加载该资源，或使用不依赖 `blob:` 脚本的加载器。
## CSP 指令 From f23711e40479851e32d1db898f039f794ff8eafb Mon Sep 17 00:00:00 2001 From: Ethan Palm <56270045+ethanpalm@users.noreply.github.com> Date: Thu, 24 Sep 2026 08:54:12 -0700 Subject: [PATCH 3/5] Apply suggestion from @ethanpalm --- deploy/csp-configuration.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/csp-configuration.mdx b/deploy/csp-configuration.mdx index 81c8e634ba..ffce274643 100644 --- a/deploy/csp-configuration.mdx +++ b/deploy/csp-configuration.mdx @@ -15,7 +15,7 @@ Mintlify sends the following policy in the `Content-Security-Policy` header of e default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: blob: https:; font-src 'self' data: https:; media-src 'self' data: blob: https:; frame-src 'self' blob: https:; connect-src 'self' data: https: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; upgrade-insecure-requests; ``` -The header also includes `frame-ancestors` and `form-action` directives that control where your site can be embedded and where forms can submit. +The header also includes `frame-ancestors` and `form-action` directives that control where you can embed your site and where forms can submit. The default policy allows resources from any HTTPS origin, so most custom scripts, embeds, fonts, and analytics tools work without changes. Browsers block resources that the policy does not allow: From 5fef4bbc4d1a60645268d7c30a928148cbddf776 Mon Sep 17 00:00:00 2001 From: Ethan Palm <56270045+ethanpalm@users.noreply.github.com> Date: Thu, 24 Sep 2026 08:54:40 -0700 Subject: [PATCH 4/5] Apply suggestion from @ethanpalm --- deploy/csp-configuration.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/csp-configuration.mdx b/deploy/csp-configuration.mdx index ffce274643..1bcdb8295d 100644 --- a/deploy/csp-configuration.mdx +++ b/deploy/csp-configuration.mdx @@ -2,7 +2,7 @@ title: "Content Security Policy (CSP) configuration" sidebarTitle: "CSP configuration" description: "Configure Content Security Policy headers to allow Mintlify resources while maintaining security for reverse proxies and strict network policies." -keywords: ["Content Security Policy", "CSP", "default CSP", "directives", "security headers", "firewall", "XSS prevention", "blocked resources"] +keywords: ["directives", "security headers", "firewall", "XSS prevention", "blocked resources"] --- Content Security Policy (CSP) is a security standard that helps prevent cross-site scripting (XSS) attacks by controlling which resources a web page can load. Mintlify enforces a default CSP on every hosted documentation site. If you host your documentation behind a reverse proxy or firewall that overwrites the default CSP, you may need to configure CSP headers for features to function properly. From 918f693a56a626fb2b3c225753794c67d397b470 Mon Sep 17 00:00:00 2001 From: Ethan Palm <56270045+ethanpalm@users.noreply.github.com> Date: Thu, 24 Sep 2026 08:56:11 -0700 Subject: [PATCH 5/5] Apply batched suggestions from code review Co-authored-by: Ethan Palm <56270045+ethanpalm@users.noreply.github.com> --- deploy/csp-configuration.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy/csp-configuration.mdx b/deploy/csp-configuration.mdx index 1bcdb8295d..aff3b57c30 100644 --- a/deploy/csp-configuration.mdx +++ b/deploy/csp-configuration.mdx @@ -19,12 +19,12 @@ The header also includes `frame-ancestors` and `form-action` directives that con The default policy allows resources from any HTTPS origin, so most custom scripts, embeds, fonts, and analytics tools work without changes. Browsers block resources that the policy does not allow: -- **HTTP resources:** Scripts, styles, fonts, and other resources must load over HTTPS. Browsers block connections to plain HTTP URLs, including local development servers such as `http://localhost:8545`. +- **HTTP resources:** Scripts, styles, fonts, and other resources must load over HTTPS. Browsers block connections to plain HTTP URLs, including local development servers. - **Blob and data scripts:** Browsers block scripts loaded from `blob:` or `data:` URLs. Some third-party tag loaders use this pattern. - **Plugins:** Browsers block `` and `` elements. - **Cross-origin workers:** Web workers must load from your documentation domain or a `blob:` URL. -If a custom script or integration stops working, check your browser console for CSP violations. See [Troubleshooting](#troubleshooting). Load the resource over HTTPS, or use a loader that doesn't rely on `blob:` scripts. +If a custom script or integration stops working, check your browser console for CSP violations. Load the resource over HTTPS, or use a loader that doesn't rely on `blob:` scripts. See [Troubleshooting](#troubleshooting) for more information. ## CSP directives