|string|null */ public $defaultSrc = 'self'; /** * Lists allowed scripts' URLs. * * @var list|string */ public $scriptSrc = [ 'self', 'unsafe-inline', 'https://cdn.jsdelivr.net', 'https://code.jquery.com', 'https://cdnjs.cloudflare.com', ]; /** * Lists allowed stylesheets' URLs. * * @var list|string */ public $styleSrc = [ 'self', 'unsafe-inline', 'https://cdn.jsdelivr.net', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com', ]; /** * Lists allowed stylesheet element URLs. * * @var list|string */ public $styleSrcElem = [ 'self', 'unsafe-inline', 'https://cdn.jsdelivr.net', 'https://fonts.googleapis.com', 'https://cdnjs.cloudflare.com', ]; /** * Allows inline style attributes used by legacy views. * * @var list|string */ public $styleSrcAttr = [ 'self', 'unsafe-inline', ]; /** * Defines the origins from which images can be loaded. * * @var list|string */ public $imageSrc = ['self', 'data:', 'https:']; /** * Restricts the URLs that can appear in a page's `` element. * * Will default to self if not overridden * * @var list|string|null */ public $baseURI; /** * Lists the URLs for workers and embedded frame contents * * @var list|string */ public $childSrc = 'self'; /** * Limits the origins that you can connect to (via XHR, * WebSockets, and EventSource). * * @var list|string */ public $connectSrc = 'self'; /** * Specifies the origins that can serve web fonts. * * @var list|string */ public $fontSrc = [ 'self', 'data:', 'https://fonts.gstatic.com', 'https://cdn.jsdelivr.net', 'https://cdnjs.cloudflare.com', ]; /** * Lists valid endpoints for submission from `

` tags. * * @var list|string */ public $formAction = 'self'; /** * Specifies the sources that can embed the current page. * This directive applies to ``, `