Improve CSP Documentation & Consider Full CSP Compliance in Plotly.js

Abierto
#7,349 2 comentarios 0 reacciones 1 asignado Ver en GitHub

@emilykl ya está trabajando en esto.

Desde el 29/1/2025.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

cs documentation feature P1
Title: Improve CSP Documentation & Consider Full CSP Compliance in Plotly.js
Description

Plotly.js provides a strict CSP bundle for users with strong Content Security Policies (CSP), but clear documentation is missing on:

  • What’s included/excluded in the strict bundle
  • Known limitations and workarounds

Enterprise customers and community users (e.g., this forum post) have requested better CSP support and clarity. The strict bundle exists (plotly-strict.js), but its usage is not well-documented.

Proposed Actions
  1. Document the strict bundle’s capabilities, limitations, and integration steps.
  2. Provide examples for CSP-compliant usage in Dash & JS.
  3. Evaluate full CSP compliance for Plotly.js instead of maintaining a separate bundle.
    • Internal enterprise customers have requested a fully CSP-compliant version.
    • Can the main plotly.js bundle be refactored to remove eval and inline scripts?
Why This Matters
  • CSP restrictions block adoption in security-sensitive environments.
  • Clear documentation would prevent confusion and production roadblocks.
  • Growing demand from enterprises & community users for strict CSP support.

Can the team consider making the main bundle fully CSP-compliant? Are there technical challenges or funding requirements for this? 🚀

Lenguaje dominante
JavaScript
Estrellas
18.3k
Forks
2k
Merge medio
2 d 12 h
PR fusionados (30 d)
28

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de plotly/plotly.js

Todos los issues de plotly/plotly.js

Issues similares

Más issues de JavaScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.