Repository: withastro/astro
File: packages/astro/src/types/public/config.ts (TypeScript)

Code before:
		 * Each pattern can specify `protocol`, `hostname`, and `port`. All three are validated if provided.
		 * The patterns support wildcards for flexible hostname matching:
		 *
		 * - `*.example.com` - matches exactly one subdomain level (e.g., `sub.example.com` but not `deep.sub.example.com`)
		 * - `**.example.com` - matches any subdomain depth (e.g., both `sub.example.com` and `deep.sub.example.com`)
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Example: Allow any subdomain of example.com on https
		 *     allowedDomains: [
		 *       {
		 *         hostname: '**.example.com',
		 *         protocol: 'https'
		 *       },
		 *       {
		 *         hostname: 'staging.myapp.com',
		 *         protocol: 'https',
		 *         port: '443'
		 *       }
		 *     ]
		 *   }
		 * }
		 * ```
		 *
		 * To allow all domains (useful for applications behind trusted reverse proxies with dynamic domains), use an empty object:
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Allow any domain - use with caution
		 *     allowedDomains: [{}]
		 *   }
		 * }
		 * ```
		 *
		 * When not configured, `X-Forwarded-Host` headers are not trusted and will be ignored.
		 */
		allowedDomains?: Partial<RemotePattern>[];

		/**
		 * @docs
		 * @name security.csp
		 * @kind h4
		 * @type {boolean | object}
		 * @default `false`
		 * @version 6.0.0
		 * @description
		 *
		 * Enables support for [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) to help minimize certain types of security threats by controlling which resources a document is allowed to load. This provides additional protection against [cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting) attacks.
		 *

Review comment (bug):
A non-blocking nit: If this should only be used with some edge cases (re: the caution in the code snippet), it might be a good idea to emphasize this in the sentence:
```suggestion
		 * In some specific contexts (e.g., applications behind trusted reverse proxies with dynamic domains), you may need to allow all domains. To do this, use an empty object:
```

Code after:
		 * Each pattern can specify `protocol`, `hostname`, and `port`. All three are validated if provided.
		 * The patterns support wildcards for flexible hostname matching:
		 *
		 * - `*.example.com` - matches exactly one subdomain level (e.g., `sub.example.com` but not `deep.sub.example.com`)
		 * - `**.example.com` - matches any subdomain depth (e.g., both `sub.example.com` and `deep.sub.example.com`)
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Example: Allow any subdomain of example.com on https
		 *     allowedDomains: [
		 *       {
		 *         hostname: '**.example.com',
		 *         protocol: 'https'
		 *       },
		 *       {
		 *         hostname: 'staging.myapp.com',
		 *         protocol: 'https',
		 *         port: '443'
		 *       }
		 *     ]
		 *   }
		 * }
		 * ```
		 *
		 * In some specific contexts (e.g., applications behind trusted reverse proxies with dynamic domains), you may need to allow all domains. To do this, use an empty object:
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Allow any domain - use this only when necessary
		 *     allowedDomains: [{}]
		 *   }
		 * }
		 * ```
		 *
		 * When not configured, `X-Forwarded-Host` headers are not trusted and will be ignored.
		 */
		allowedDomains?: Partial<RemotePattern>[];

		/**
		 * @docs
		 * @name security.csp
		 * @kind h4
		 * @type {boolean | object}
		 * @default `false`
		 * @version 6.0.0
		 * @description
		 *
		 * Enables support for [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) to help minimize certain types of security threats by controlling which resources a document is allowed to load. This provides additional protection against [cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting) attacks.
		 *