add support for base-uri

[selfagency]

it's in csp2 and mozilla's observer is using it to judge the security of sites

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/base-uri

[EvanHahn]

I believe base-uri is already supported, though not properly documented. Does something like this work for you?

app.use(csp({
  directives: {
    baseUri: ['https://example.com']
  }
}))

[wolfgang42]

I had the same confusion; baseUri works fine but I had to take a guess that it might work since it's not documented.

[EvanHahn]

Good point. I'll document this now.

[EvanHahn]

Documented in e0265b0 and on the docs site.

[wolfgang42]

Thanks, that's much better!

[EvanHahn]

@wolfgang42 thanks for prodding me, and thanks to @selfagency for reporting the issue!