Topic on Talk:Requests for comment/Content-Security-Policy

First off, glad it's finally implemented.

Am I off with the syntax? @Bawolff

$wgCSPHeader = [
       'default-src' => [
               'self'
       ],
       'img-src' => [
               'site.com'
       ],
       'style-src' => [
               'site1.com',
               'site2.com'
       ]
];

default-src appears to register, but not img-src nor style-src.

I had to use "'self'" so that it has single quotes in the browser:

$wgCSPHeader = [
  'default-src' => [
    "'self'"
  ]
]