From b15ea010a9c183fff29737e77d7ef8480829cea0 Mon Sep 17 00:00:00 2001
From: Arman Ozak <arman@armanozak.com>
Date: Thu, 2 Apr 2020 20:01:15 +0300
Subject: [PATCH] docs(core): add how content security strategies work

---
 .../UI/Angular/Content-Security-Strategy.md   | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 docs/en/UI/Angular/Content-Security-Strategy.md

diff --git a/docs/en/UI/Angular/Content-Security-Strategy.md b/docs/en/UI/Angular/Content-Security-Strategy.md
new file mode 100644
index 0000000000..96418a04cb
--- /dev/null
+++ b/docs/en/UI/Angular/Content-Security-Strategy.md
@@ -0,0 +1,53 @@
+# ContentSecurityStrategy
+
+`ContentSecurityStrategy` is an abstract class exposed by @abp/ng.core package. Its instances help you mark inline script or styles as safe in terms of [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy).
+
+
+
+
+## API
+
+
+### constructor(public nonce?: string)
+
+`nonce` enables whitelisting inline script or styles in order to avoid using `unsafe-inline` in [script-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#Unsafe_inline_script) and [style-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src#Unsafe_inline_styles) directives.
+
+
+### applyCSP(element: HTMLScriptElement | HTMLStyleElement): void
+
+This method maps the aforementioned properties to the given `element`.
+
+
+
+## LooseContentSecurityPolicy
+
+`LooseContentSecurityPolicy` is a class that extends `ContentSecurityStrategy`. It required `nonce` and marks given `<script>` or `<style>` tag with it.
+
+
+
+## StrictContentSecurityPolicy
+
+`StrictContentSecurityPolicy` is a class that extends `ContentSecurityStrategy`. It does not mark inline scripts and styles as safe. You can consider it as a noop alternative.
+
+
+
+## Predefined Content Security Strategies
+
+Predefined content security strategies are accessible via `CONTENT_SECURITY_STRATEGY` constant.
+
+
+### Loose(nonce: string)
+
+`nonce` will be set.
+
+
+### Strict()
+
+Nothing will be done.
+
+
+
+
+## What's Next?
+
+TODO: Place new InsertionStrategy link here.