Clojurians Log v2

How do I tweak Content Security Policy in Pedestal?

Inside service-map

::http/port 8080
::http/secure-headers {:content-security-policy-settings content-security-policy-settings}
...

docs here https://cljdoc.org/d/io.pedestal/pedestal.service/0.5.5/api/io.pedestal.http.secure-headers @ahmed1hsn

docs aren't awesome, but you can checkout the sources. it's just a bunch of string concat/join

So, If I have set up http/secure-headers in service-map I do not need to include &lt;meta http-equiv="Content-Security-Policy" content="default-src <https://cdn.example.net>; child-src 'none'; object-src 'none'"&gt; Tag in html. Right?

https://developers.google.com/web/fundamentals/security/csp/#the_meta_tag

Yep. Choose one method (headers or meta-tags). https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta#attr-http-equiv