Improve this doc  View Source

ngCsp

  1. - directive in module ng

Enables CSP (Content Security Policy) support.

This is necessary when developing things like Google Chrome Extensions.

CSP forbids apps to use eval or Function(string) generated functions (among other things). For us to be compatible, we just need to implement the "getterFn" in $parse without violating any of these restrictions.

AngularJS uses Function(string) generated functions as a speed optimization. Applying the ngCsp directive will cause Angular to use CSP compatibility mode. When this mode is on AngularJS will evaluate all expressions up to 30% slower than in non-CSP mode, but no security violations will be raised.

CSP forbids JavaScript to inline stylesheet rules. In non CSP mode Angular automatically includes some CSS rules (e.g. ngCloak). To make those directives work in CSP mode, include the angular-csp.css manually.

In order to use this feature put the ngCsp directive on the root element of the application.

Note: This directive is only available in the ng-csp and data-ng-csp attribute form.

Directive Info

Usage

Example

This example shows how to apply the ngCsp directive to the html tag.

     <!doctype html>
     <html ng-app ng-csp>
     ...
     ...
     </html>