Commits
Tarun Sukhani authored de0cb307514
fix: disable CSP by default in new app skel The framework's SecurityHeadersPlugin still defaults to "default-src 'self'" — that's the right defensive baseline for the framework. But the CSP value is restrictive enough (blocks inline scripts/styles, eval, data: URIs, external resources) that it trips up almost every starter page and frontend framework on first run, which is a confusing initial experience. Override the CSP in the skel application.conf with an empty value, which the SecurityHeadersPlugin reads as "skip this header." Other security headers (X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy, HSTS) remain at their conservative framework defaults — those don't break common starter content. Skel comments explain the rationale and show how to enable a real CSP once the developer has designed one for their app. CLI test added in test_cli.TestPlayNew.test_csp_disabled_by_default asserts the active config line is the empty assignment (not a commented example). Existing apps that already defined their own http.headers.contentSecurityPolicy override are unaffected — only the new-app skel changes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>