Content Security Policy

[axel31]

Hi,

I want to write a Content-Security-Policy, but I am facing trouble. On my htaccess, I have written

Header set Content-Security-Policy "default-src 'self';"

but all the javascript codes don't work anymore. I thought that with self and defaut it would authorize the javascript from my server (for now localhost for my test)...

Does anyone know how to write it properly?

Thanks for help

 

[pixelicous]

Waking up an old topic i stumbled upon as well.. if anyone got a good header set, that would be lovely