

First have a look at the report header Content-Security-Policy-Report-Only add things you know about, as that will allow you to log what you need to have setup. Then once you have a list of things you know you need, add them and what the logs again. adding in things as you see and verify them.
Thank you for this! I feel as if I got the idea however, failed on the execution. I added this to my routers.yml
-
contentSecurityPolicyReportOnly: "child-src; connect-src; default-src; font-src; frame-src; img-src; manifest-src; media-src; object-src; script-src; script-src-elem; script-src-attr; style-src; style-src-elem; style-src-attr; worker-src; report-to csp-report"
To my understanding the report-to
directive at the end adds a endpoint called /csp-report
yet in my testing it doesn’t appear to exist and just leads to 403, I’m likely doing something totally wrong but I appreciate you pointing me in the right direction!
Also dont just add things in without checking that its in your code, you dont want to add
hack-me.com
by mistake.
That’s fair, I’m certainly no wiz at programming and this is just self-hosted docker applications that I’ve jerry-rigged to work with one another.
I guess this is a pro for AirPods because I don’t think I’ve encountered this in the many years of owning em.