Strict Content Security Policy

Mon, 01 Jan 0001 00:00:00 +0000

Do I need this guide?

Gate One does not add a Content Security Policy unless a route declares a csp block. If you only proxy a page through Gate One, with no csp block and no custom injection, there is nothing to do: the page’s own policy (if any) passes through unchanged.

your situation what to do

your situation	what to do
page proxied by Gate One, no `csp` block, no custom injection, and the page sends no CSP	nothing: Gate One adds no CSP.
page proxied, but the page already sends a CSP	the browser enforces it. The guard’s inline script/style must be allowed by that policy, or the guard is blocked. Configure Gate One `csp.mode: "merge"` (script hashes) or `"nonce"`, and make the app’s `style-src` compatible with the guard style. See “An application that already has a CSP”.
you enable `csp` on a route	this guide applies.
you inject custom HTML/CSS/JS (`inject`, userscripts, plugins)	this guide applies: your injected content must satisfy the policy.
you proxy an external site that sends a CSP	both policies are enforced; the origin’s policy can block the guard. See “External sites and `upstream`”.

page proxied by Gate One, no csp block, no custom injection, and the page sends no CSP

nothing: Gate One adds no CSP.

page proxied, but the page already sends a CSP

the browser enforces it. The guard’s inline script/style must be allowed by that policy, or the guard is blocked. Configure Gate One csp.mode: "merge" (script hashes) or "nonce", and make the app’s style-src compatible with the guard style. See “An application that already has a CSP”.

you enable csp on a route

this guide applies.

you inject custom HTML/CSS/JS (inject, userscripts, plugins)

this guide applies: your injected content must satisfy the policy.

you proxy an external site that sends a CSP

both policies are enforced; the origin’s policy can block the guard. See “External sites and upstream”.

You need this guide in the last four cases.

Declarative UI gating

Mon, 01 Jan 0001 00:00:00 +0000

This guide is the contract for the declarative gating attributes read by the injected guard script. The behavioural matrix at the end is the one executed by test/ui/controls.mjs against the page fixture test/ui/controls.html.

Attributes

Attribute Meaning

Attribute	Meaning
`data-gtw-auth="before"`	The action is neutralised while anonymous: `preventDefault()` `stopPropagation()`, then the login tab opens. Authenticate first, act after. Activation only: turning a feature OFF is a deactivation and is always let through without login.
`data-gtw-auth="after"`	The native action proceeds while anonymous; the login tab opens as an invitation. The 401 request produced by the action is queued and replayed after login. Activation only: a deactivation does not open the login tab.
`data-gtw-auth-off="value"`	For value controls (`select`, `range`, `date`, `time`, `datetime-local`, `month`, `week`, `color`): the value considered OFF. Moving to it is a deactivation (free); moving away from it is an activation. Default: the control’s default value (for a `select`: the option carrying `selected`, otherwise the first option). Ignored by the other control families.
`data-gtw-auth-hidden="before"`	Hidden while anonymous, shown once authenticated. Activating clicks are neutralised and show the sign-in banner; a checked checkbox may still be unchecked (deactivation).
`data-gtw-auth-hidden="after"`	Visible while anonymous, hidden once authenticated (pure affordance, composable with `data-gtw-auth="before"` for padlocks).
`data-gtw-roles`, `data-gtw-scopes`, `data-gtw-claims`	Identity-conditioned visibility, evaluated after the session probe.
`data-gtw-logout`	Wires the click to the OIDC logout navigation. Authenticated only.

data-gtw-auth="before"

The action is neutralised while anonymous: preventDefault()
stopPropagation(), then the login tab opens. Authenticate first, act after. Activation only: turning a feature OFF is a deactivation and is always let through without login.

data-gtw-auth="after"

The native action proceeds while anonymous; the login tab opens as an invitation. The 401 request produced by the action is queued and replayed after login. Activation only: a deactivation does not open the login tab.

data-gtw-auth-off="value"

For value controls (select, range, date, time, datetime-local, month, week, color): the value considered OFF. Moving to it is a deactivation (free); moving away from it is an activation. Default: the control’s default value (for a select: the option carrying selected, otherwise the first option). Ignored by the other control families.

data-gtw-auth-hidden="before"

Hidden while anonymous, shown once authenticated. Activating clicks are neutralised and show the sign-in banner; a checked checkbox may still be unchecked (deactivation).

data-gtw-auth-hidden="after"

Visible while anonymous, hidden once authenticated (pure affordance, composable with data-gtw-auth="before" for padlocks).

data-gtw-roles, data-gtw-scopes, data-gtw-claims

Identity-conditioned visibility, evaluated after the session probe.

data-gtw-logout

Wires the click to the OIDC logout navigation. Authenticated only.

Markup wins over the equivalent uiGate rule: an element carrying a data-gtw-auth (or data-gtw-auth-hidden) attribute is not affected by a config rule for the same dimension.

data-gtw-claims (and uiGate[].claims) takes a JSON object: each key must match, each value is one accepted string or a list of accepted strings (OR / anyOf on the same claim), and "*" means "claim present". A token claim that is itself a list (groups, token roles…) matches when one element matches. Example: data-gtw-claims='{"email": ["alice@example.com", "a.rolland@example.com"]}'.

Guides on Gate One

Strict Content Security Policy

Do I need this guide?

Declarative UI gating

Attributes