CSP for Heroicons: Copy-Paste Policy Examples
Heroicons are the easy case for CSP, which is nice for once. If you use Heroicons the normal way — React components, Vue components, Blade components, or copied inline SVG markup — Heroicons do not require their own domain in your Content Security Policy. There’s no Heroicons CDN you need to allow. No remote script. No remote font. Usually no remote image either. That means your CSP for Heroicons is mostly about how you render the SVGs. ...