Repository: withastro/astro
File: packages/astro/src/types/public/config.ts (TypeScript)

Code before:
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Example: Allow any subdomain of example.com on https
		 *     allowedDomains: [
		 *       {
		 *         hostname: '**.example.com',
		 *         protocol: 'https'
		 *       },
		 *       {
		 *         hostname: 'staging.myapp.com',
		 *         protocol: 'https',
		 *         port: '443'
		 *       }
		 *     ]
		 *   }
		 * }
		 * ```
		 *
		 * To allow all domains (useful for applications behind trusted reverse proxies with dynamic domains), use an empty object:
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Allow any domain - use with caution
		 *     allowedDomains: [{}]
		 *   }
		 * }
		 * ```
		 *
		 * When not configured, `X-Forwarded-Host` headers are not trusted and will be ignored.
		 */
		allowedDomains?: Partial<RemotePattern>[];

		/**
		 * @docs
		 * @name security.csp
		 * @kind h4
		 * @type {boolean | object}
		 * @default `false`
		 * @version 6.0.0
		 * @description
		 *
		 * Enables support for [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) to help minimize certain types of security threats by controlling which resources a document is allowed to load. This provides additional protection against [cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting) attacks.
		 *
		 * Enabling this feature adds additional security to Astro's handling of processed and bundled scripts and styles by default, and allows you to further configure these, and additional, content types.
		 *
		 * This feature comes with some limitations:
		 * - External scripts and external styles are not supported out of the box, but you can [provide your own hashes](https://v6.docs.astro.build/en/reference/configuration-reference/#hashes).
		 * - [Astro's view transitions](https://v6.docs.astro.build/en/guides/view-transitions/) using the `<ClientRouter />` are not supported, but you can [consider migrating to the browser native View Transition API](https://events-3bg.pages.dev/jotter/astro-view-transitions/) instead if you are not using Astro's enhancements to the native View Transitions and Navigation APIs.

Review comment (suggestion):
Maybe "only when necessary" is a little less vague than "with caution"? (but I'm really nitpicking...)
```suggestion
		 *     // Allow any domain - use this only when necessary
```

Code after:
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Example: Allow any subdomain of example.com on https
		 *     allowedDomains: [
		 *       {
		 *         hostname: '**.example.com',
		 *         protocol: 'https'
		 *       },
		 *       {
		 *         hostname: 'staging.myapp.com',
		 *         protocol: 'https',
		 *         port: '443'
		 *       }
		 *     ]
		 *   }
		 * }
		 * ```
		 *
		 * In some specific contexts (e.g., applications behind trusted reverse proxies with dynamic domains), you may need to allow all domains. To do this, use an empty object:
		 *
		 * ```js
		 * {
		 *   security: {
		 *     // Allow any domain - use this only when necessary
		 *     allowedDomains: [{}]
		 *   }
		 * }
		 * ```
		 *
		 * When not configured, `X-Forwarded-Host` headers are not trusted and will be ignored.
		 */
		allowedDomains?: Partial<RemotePattern>[];

		/**
		 * @docs
		 * @name security.csp
		 * @kind h4
		 * @type {boolean | object}
		 * @default `false`
		 * @version 6.0.0
		 * @description
		 *
		 * Enables support for [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) to help minimize certain types of security threats by controlling which resources a document is allowed to load. This provides additional protection against [cross-site scripting (XSS)](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting) attacks.
		 *
		 * Enabling this feature adds additional security to Astro's handling of processed and bundled scripts and styles by default, and allows you to further configure these, and additional, content types.
		 *
		 * This feature comes with some limitations:
		 * - External scripts and external styles are not supported out of the box, but you can [provide your own hashes](https://v6.docs.astro.build/en/reference/configuration-reference/#hashes).
		 * - [Astro's view transitions](https://v6.docs.astro.build/en/guides/view-transitions/) using the `<ClientRouter />` are not supported, but you can [consider migrating to the browser native View Transition API](https://events-3bg.pages.dev/jotter/astro-view-transitions/) instead if you are not using Astro's enhancements to the native View Transitions and Navigation APIs.