Custom scripts

​

Custom scripts

script.js               # runs first
analytics.js            # then every other script, sorted by path
scripts/chat-widget.js
scripts/tracking/hotjar.js

• These files are plain browser JavaScript rather than modules, so import and export don’t work in them, and you load a library from another host with document.createElement("script") and add that host to allowedOrigins.
• The build checks the syntax without running your scripts, and a syntax error fails the build with the file name and line number.
• Your MDX can’t import these files, so for a component, use a snippet in snippets/ instead.

// Open links to other sites in a new tab.
for (const link of document.querySelectorAll("main a[href^='http']")) {
  if (link.host !== location.host) {
    link.target = "_blank";
    link.rel = "noopener";
  }
}

​

Content-Security-Policy

• Scripts can come from your site, the analytics integrations you turned on and your allowedOrigins. Notra hashes every inline script that was on the page at build time into the policy, so the browser blocks any inline script injected later.
• Connections from fetch, beacons and WebSockets may go to your site, your integrations and your allowedOrigins.
• The policy doesn’t limit images, styles, fonts, videos and embeds, so posts can still show images and videos from anywhere.

{
  "security": {
    "allowedOrigins": [
      "https://cdn.example-widget.com",
      "https://*.example-widget.com",
      "wss://*.example-widget.com"
    ]
  }
}

{
  "security": { "contentSecurityPolicy": false }
}