C2 · back to all sections

Strict meta CSP

This page carries its own Content-Security-Policy in a <meta> tag, as some customer sites do. MarkUp's proxy strips CSP headers but not meta tags, so the policy still applies inside the MarkUp iframe. Nobody has reported this in the snapdom issues; this page is the experiment.

default-src 'self';
img-src 'self' data: blob: https:;
style-src 'self';
font-src 'self';
script-src 'self';
connect-src 'self'

In MarkUp (preview, 3.0.0 via proxy)

Unknown. Possible outcomes, roughly in order of severity:

• MarkUp's bundle is blocked by script-src, so pins or screenshots don't work at all.
• The capture runs but loses styling: snapdom adds <style> elements, which style-src 'self' blocks (3.4.0 has a fix for a related case).
• The capture loses images: connect-src 'self' blocks direct fetches, though MarkUp's CORS relay is on the same origin as the proxied page.
• Everything works.

Check the browser console for CSP violation messages and note which ones appear.

Raw snapdom / SDK

Not testable from this page: the policy blocks loading snapdom from a CDN, which is itself what a customer would hit with the SDK's script tag.