26 directives

Content-Security-Policy

worker-src Keyword —
'self'
worker-src Scheme —
blob:
object-src Keyword —
'none'
base-uri Keyword —
'self'
upgrade-insecure-requests Source —
(no sources)
frame-ancestors Keyword —
'self'
form-action Keyword —
'self'
default-src Keyword —
'self'
default-src Scheme —
https:
script-src Keyword —
'self'
script-src Keyword —
'unsafe-inline'
script-src Keyword —
'unsafe-eval'
script-src Scheme —
https:
style-src Keyword —
'self'
style-src Keyword —
'unsafe-inline'
style-src Scheme —
https:
img-src Keyword —
'self'
img-src Scheme —
data:
img-src Scheme —
blob:
img-src Scheme —
https:
font-src Keyword —
'self'
font-src Scheme —
data:
font-src Scheme —
https:
media-src Keyword —
'self'
media-src Scheme —
data:
media-src Scheme —
blob:
media-src Scheme —
https:
frame-src Keyword —
'self'
frame-src Scheme —
blob:
frame-src Scheme —
https:
connect-src Keyword —
'self'
connect-src Scheme —
data:
connect-src Scheme —
https:
connect-src Scheme —
wss:

Content-Security-Policy-Report-Only

default-src Keyword —
'self'
default-src Scheme —
https:
script-src Keyword —
'self'
script-src Keyword —
'unsafe-inline'
script-src Keyword —
'unsafe-eval'
script-src Scheme —
https:
style-src Keyword —
'self'
style-src Keyword —
'unsafe-inline'
style-src Scheme —
https:
img-src Keyword —
'self'
img-src Scheme —
data:
img-src Scheme —
blob:
img-src Scheme —
https:
font-src Keyword —
'self'
font-src Scheme —
data:
font-src Scheme —
https:
media-src Keyword —
'self'
media-src Scheme —
data:
media-src Scheme —
blob:
media-src Scheme —
https:
frame-src Keyword —
'self'
frame-src Scheme —
blob:
frame-src Scheme —
https:
connect-src Keyword —
'self'
connect-src Scheme —
data:
connect-src Scheme —
https:
connect-src Scheme —
wss:
worker-src Keyword —
'self'
worker-src Scheme —
blob:
object-src Keyword —
'none'
report-uri Host —
report-to Host —