CSP array format

[incoming-th]

Hi,

Quick question, for the CSP array format should it be like this:

'csp' => [ 'default-src' => [ 'self', config('app.url') ],

or like this:

'csp' => [ 'default-src' => [ 'self' => true, 'allow' => [ config('app.url') ] ],

Thanks

[bepsvpt]

'csp' => [ 'default-src' => [ 'self' => true, 'allow' => [ config('app.url') ] ], is the correct one.

In most cases, 'self' => true will allow your website to load assets from the same domain.