docs: Clarifies CSP usage with file:// resources

[Nantris]

Description of Change

Checklist

• relevant documentation is changed or added
• PR title follows semantic commit guidelines

Release Notes

Notes: Previously it was not noted that the HTTP header method could not work with the file:// protocol.

[welcome]

💖 Thanks for opening this pull request! 💖

We use semantic commit messages to streamline the release process. Before your pull request can be merged, you should update your pull request title to start with a semantic prefix.

Examples of commit messages with semantic prefixes:

• fix: don't overwrite prevent_default if default wasn't prevented
• feat: add app.isPackaged() method
• docs: app.isDefaultProtocolClient is now available on Linux

Things that will help get your PR across the finish line:

• Follow the JavaScript, C++, and Python coding style.
• Run npm run lint locally to catch formatting errors earlier.
• Document any user-facing changes you've made following the documentation styleguide.
• Include tests when adding/changing behavior.
• Include screenshots and animated GIFs whenever possible.

We get a lot of pull requests on this repo, so please be patient and we will get back to you as soon as we can.

[busticated]

good stuff 👏

i think it's worth also noting a few other things:

1. the example usage of onHeadersReceived() is wrong - specifically the { responseHeaders: default-src 'none' } format should be 👉 https://stackoverflow.com/a/52243138/579167 (i think?)
2. CSP headers only need to be set for Content-Type: text/html (and application/xhtml+xml and application/xml - anything that generates an interactive document) responses

[codebytere]

@slapbox agree with the above; if you could address these comments we can look to getting this merged!

[Nantris]

@codebytere @busticated thanks for your reviews. I'd be happy to update this, but because I've never actually set headers this way due to exclusive use of the file:// protocol in my projects, I'd be worried about updating the docs with inaccurate information. Can anyone confirm the below is accurate?

the example usage of onHeadersReceived() is wrong - specifically the { responseHeaders:default-src 'none'} format should be point_right https://stackoverflow.com/a/52243138/579167 (i think?)

[zcbenz]

The other notes are additional to other chapters, and do not conflict with this PR which only adds new content to "CSP Meta Tag", please start a new PR to add new content.

[release-clerk]

Release Notes Persisted

Previously it was not noted that the HTTP header method could not work with the file:// protocol.

[welcome]

Congrats on merging your first pull request! 🎉🎉🎉