# @ampproject/toolbox-script-csp
> A library that calculates the CSP hash for amp-script
Latest version **2.10.1** (published 2024-06-14) · Apache-2.0 license · 0 weekly downloads
## Install
```sh
npm install @ampproject/toolbox-script-csp
pnpm add @ampproject/toolbox-script-csp
yarn add @ampproject/toolbox-script-csp
bun add @ampproject/toolbox-script-csp
```
## Health
**Score 15/100 (F)** — status: abandoned.
Positive: no vulnerabilities.
Warnings: low downloads; no types; no esm support.
Negative: abandoned; low maintenance score.
## Facts
| | |
|---|---|
| Version | 2.10.1 |
| Published | 2024-06-14 |
| First published | 2019-08-29 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 5.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 459 |
| Author | AMPHTML Team |
| Maintainers | ampproject-admin, kristoferbaxter, jridgewell, choumx, amp-toolbox, fstanis, erwinmombay, samouri, caroqliu, rsimha, dvoytenko, patrickkettner, alanorozco, kdwan, ampprojectbot, esth |
| Keywords | amp |
## Links
- npm: https://www.npmjs.com/package/@ampproject/toolbox-script-csp
- Repository: https://github.com/ampproject/amp-toolbox
- Homepage: https://github.com/ampproject/amp-toolbox/tree/main/packages/script-csp
- Issues: https://github.com/ampproject/amp-toolbox/issues
- npm.io page: https://npm.io/package/@ampproject/toolbox-script-csp
## Recent versions
- 2.10.1 (latest) — 2024-06-14
- 2.8.0-canary.0 (canary) — 2021-02-12
- 1.1.0-beta.0 (beta) — 2019-08-29
- 2.10.0 — 2024-06-13
- 2.9.0 — 2022-06-23
- 2.8.0 — 2021-05-31
- 2.5.4 — 2020-06-22
- 2.3.0 — 2020-04-15
- 2.2.0 — 2020-04-03
- 2.1.0 — 2020-04-01
- 2.0.0 — 2020-02-13
- 2.0.0-alpha.0 — 2020-01-22
- 1.1.1 — 2019-10-08
- 1.1.0 — 2019-10-08
- 1.1.0-beta.1 — 2019-09-19
## README
# AMP-Toolbox Script CSP
[](https://badge.fury.io/js/%40ampproject%2Ftoolbox-script-csp)
Calculates the [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
hash for the given script in the format expected by [`amp-script`](https://amp.dev/documentation/components/amp-script/).
CSP is required when using `amp-script` with inline or cross-origin scripts.
## Usage
Install via:
```
$ npm install @ampproject/toolbox-script-csp
```
### Using the module
The module exposes a single function, `calculateHash(src, options?)`.
`src` can be either a string (in which case UTF8 encoding is assumed) or a
[`DataView`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/DataView)
such as a [`Buffer`](https://nodejs.org/api/buffer.html).
`options` is used to override the default options.
#### Options
* `algorithm` overrides the hashing algorithm to use. Currently, the only
algorithm supported by `amp-script` is `sha384` which is the default value.
### Example
Here is an example on how to use the `calculateHash` function to generate an
`amp-script` CSP header.
Note that both leading and trailing whitespace is included in calculating the
hash and must exactly match the whitespace used in the inline script.
```javascript
const {calculateHash} = require('@ampproject/toolbox-script-csp');
const script = `
const subject = 'world';
console.log('Hello, ' + subject);
`;
const hash = calculateHash(script);
console.log(hash); // sha384-xRxb5sv13at6tVgZET4JLmf89TSZP10HjCGXVqO9bKWVXB0asV2jLrsDN8v4zX6j
```
The generated hash can be used in a `` tag this way:
```html
...
...
```
---
_Source: https://npm.io/package/@ampproject/toolbox-script-csp · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._