Menu

## ContentSecurityPolicy extends BaseConfig
in package

ContentSecurityPolicy.php : 16

Stores the default settings for the ContentSecurityPolicy, if you choose to use it. The values here will be read in and set as defaults for the site. If needed, they can be overridden on a page-by-page basis.

Suggested reference for explanations:

##### Tags

see
  https://www.html5rocks.com/en/tutorials/security/content-security-policy/

### Table of Contents

#### Properties

$autoNonce : bool
  Replace nonce tag automatically
$baseURI : array<int, string>|string|null
  Restricts the URLs that can appear in a page's `<base>` element.
$childSrc : array<int, string>|string
  Lists the URLs for workers and embedded frame contents
$connectSrc : array<int, string>|string
  Limits the origins that you can connect to (via XHR, WebSockets, and EventSource).
$defaultSrc : array<int, string>|string|null
  Will default to self if not overridden
$fontSrc : array<int, string>|string
  Specifies the origins that can serve web fonts.
$formAction : array<int, string>|string
  Lists valid endpoints for submission from `<form>` tags.
$frameAncestors : array<int, string>|string|null
  Specifies the sources that can embed the current page.
$frameSrc : array<int, string>|string|null
  The frame-src directive restricts the URLs which may be loaded into nested browsing contexts.
$imageSrc : array<int, string>|string
  Defines the origins from which images can be loaded.
$manifestSrc : array<int, string>|string|null
$mediaSrc : array<int, string>|string|null
  Restricts the origins allowed to deliver video and audio.
$objectSrc : array<int, string>|string
  Allows control over Flash and other plugins.
$pluginTypes : array<int, string>|string|null
  Limits the kinds of plugins a page may invoke.
$reportOnly : bool
  Default CSP report context
$reportURI : string|null
  Specifies a URL where a browser will send reports when a content security policy is violated.
$sandbox : array<int, string>|string|null
  List of actions allowed.
$scriptNonceTag : string
  Nonce tag for script
$scriptSrc : array<int, string>|string
  Lists allowed scripts' URLs.
$styleNonceTag : string
  Nonce tag for style
$styleSrc : array<int, string>|string
  Lists allowed stylesheets' URLs.
$upgradeInsecureRequests : bool
  Instructs user agents to rewrite URL schemes, changing HTTP to HTTPS. This directive is for websites with large numbers of old URLs that need to be rewritten.

### Properties

#### $autoNonce

ContentSecurityPolicy.php : 175

Replace nonce tag automatically

`public bool $autoNonce = true`

#### $baseURI

ContentSecurityPolicy.php : 80

Restricts the URLs that can appear in a page's `<base>` element.

`public array<int, string>|string|null $baseURI`

Will default to self if not overridden

#### $childSrc

ContentSecurityPolicy.php : 87

Lists the URLs for workers and embedded frame contents

`public array<int, string>|string $childSrc = 'self'`

#### $connectSrc

ContentSecurityPolicy.php : 95

Limits the origins that you can connect to (via XHR, WebSockets, and EventSource).

`public array<int, string>|string $connectSrc = 'self'`

#### $defaultSrc

ContentSecurityPolicy.php : 50

Will default to self if not overridden

`public array<int, string>|string|null $defaultSrc`

#### $fontSrc

ContentSecurityPolicy.php : 102

Specifies the origins that can serve web fonts.

`public array<int, string>|string $fontSrc`

#### $formAction

ContentSecurityPolicy.php : 109

Lists valid endpoints for submission from `<form>` tags.

`public array<int, string>|string $formAction = 'self'`

#### $frameAncestors

ContentSecurityPolicy.php : 119

Specifies the sources that can embed the current page.

`public array<int, string>|string|null $frameAncestors`

This directive applies to `<frame>`, `<iframe>`, `<embed>`, and `<applet>` tags. This directive can't be used in `<meta>` tags and applies only to non-HTML resources.

#### $frameSrc

ContentSecurityPolicy.php : 127

The frame-src directive restricts the URLs which may be loaded into nested browsing contexts.

`public array<int, string>|string|null $frameSrc`

#### $imageSrc

ContentSecurityPolicy.php : 71

Defines the origins from which images can be loaded.

`public array<int, string>|string $imageSrc = 'self'`

#### $manifestSrc

ContentSecurityPolicy.php : 146
`public array<int, string>|string|null $manifestSrc`

#### $mediaSrc

ContentSecurityPolicy.php : 134

Restricts the origins allowed to deliver video and audio.

`public array<int, string>|string|null $mediaSrc`

#### $objectSrc

ContentSecurityPolicy.php : 141

Allows control over Flash and other plugins.

`public array<int, string>|string $objectSrc = 'self'`

#### $pluginTypes

ContentSecurityPolicy.php : 153

Limits the kinds of plugins a page may invoke.

`public array<int, string>|string|null $pluginTypes`

#### $reportOnly

ContentSecurityPolicy.php : 25

Default CSP report context

`public bool $reportOnly = false`

#### $reportURI

ContentSecurityPolicy.php : 31

Specifies a URL where a browser will send reports when a content security policy is violated.

`public string|null $reportURI = null`

#### $sandbox

ContentSecurityPolicy.php : 160

List of actions allowed.

`public array<int, string>|string|null $sandbox`

#### $scriptNonceTag

ContentSecurityPolicy.php : 170

Nonce tag for script

`public string $scriptNonceTag = '{csp-script-nonce}'`

#### $scriptSrc

ContentSecurityPolicy.php : 57

Lists allowed scripts' URLs.

`public array<int, string>|string $scriptSrc = 'self'`

#### $styleNonceTag

ContentSecurityPolicy.php : 165

Nonce tag for style

`public string $styleNonceTag = '{csp-style-nonce}'`

#### $styleSrc

ContentSecurityPolicy.php : 64

Lists allowed stylesheets' URLs.

`public array<int, string>|string $styleSrc = 'self'`

#### $upgradeInsecureRequests

ContentSecurityPolicy.php : 38

Instructs user agents to rewrite URL schemes, changing HTTP to HTTPS. This directive is for websites with large numbers of old URLs that need to be rewritten.

`public bool $upgradeInsecureRequests = false`

## Search results