Security
Content Security Policy
What to allow in your CSP for the engine and charts to run.
Directives
| Directive | Why |
|---|---|
script-src 'self' | The SDK script (or your bundle). |
worker-src 'self' blob: | Rendering and parsing workers load from your origin; DuckDB starts its worker from a blob URL. |
script-src 'wasm-unsafe-eval' | WebAssembly: the HDF5 / MAT 7.3 reader, and DuckDB-WASM for files too large for memory. |
connect-src 'self' blob: | Only if users open files too large for memory (over 100 million values or 300 MB): DuckDB-WASM, bundled with the SDK in assets/, is fetched from your origin and handed to its worker as a blob URL. |
connect-src wss://<relay> | Only for relay streams. |
Styles and fonts
The SDK injects no <style> elements and no style attributes in markup: charts set their sizes and colour variables through the DOM style API, which CSP does not restrict. charts.css is a normal stylesheet you serve yourself, and the SDK's JavaScript loads no fonts: use whatever your page already loads and pass it to engine.charts.setFonts(). The optional tokens.css declares its typeface from woff2 files shipped beside it in styles/fonts/, served from your origin (font-src 'self'), never from a font CDN.