Why Astro's Native security.csp Breaks on Shiki (And Why Switching to Prism Is a Bad Trade)
Why Astro's native security.csp hits a wall with Shiki's inline styles, why switching to Prism degrades code readability, and how build-time extraction delivers zero unsafe-inline security. Whenever I mention my astro-strict-csp package, the first question developers usually ask is: "Wait, doesn't Astro already have built-in security.csp in astro.config.mjs?" It does—and Astro's native security.csp is actually the exact reason I still needed to build astro-strict-csp. Here is why Astro's native CSP hits that wall, why switching from Shiki to Prism is a painful downgrade for a technical blog, and how extracting inline styles at build time solves both problems cleanly. To be fair to the Astro team, this limitation comes directly from the W3C Content Security Policy specification itself: Because Astro's native CSP pipeline doesn't rewrite HTML attributes into external stylesheets, turning…