View source Improve this doc

ngCsp
directive in module ng

Description

Enables CSP (Content Security Policy) support.

This is necessary when developing things like Google Chrome Extensions.

CSP forbids apps to use eval or Function(string) generated functions (among other things). For us to be compatible, we just need to implement the "getterFn" in $parse without violating any of these restrictions.

AngularJS uses Function(string) generated functions as a speed optimization. By applying ngCsp it is be possible to opt into the CSP compatible mode. When this mode is on AngularJS will evaluate all expressions up to 30% slower than in non-CSP mode, but no security violations will be raised.

In order to use this feature put ngCsp directive on the root element of the application.

Usage

as attribute
<html ng-csp>
   ...
</html>
as class
<html class="ng-csp">
   ...
</html>

Directive info

  • This directive executes at priority level 1000.

Example

This example shows how to apply the ngCsp directive to the html tag. 

  <!doctype html>
  <html ng-app ng-csp>
  ...
  ...
  </html>