d9ping / cspgenerator Goto Github PK

Address TODO on:

Font-src directive support is added on version 25 >=
Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src

I am testing CSPGenerator and pretty much all is good with exception to the following when processing a Lighthouse Report.

Host allowlists can frequently be bypassed. Consider using 'strict-dynamic' in combination with CSP nonces or hashes.
No CSP configures a reporting destination. This makes it difficult to maintain the CSP over time and monitor for any breakages.

This is the code currently

require_once( 'assets/php/classes/csp/CSPGenerator.php' );
CSPGenerator::getInstance()->addScriptsrc( 'https://maps.googleapis.com' );
CSPGenerator::getInstance()->addStylesrc( 'https://cdn.jsdelivr.net' );
CSPGenerator::getInstance()->addStylesrc( 'https://fonts.googleapis.com' );
CSPGenerator::getInstance()->addFontsrc( 'https://fonts.gstatic.com' );
CSPGenerator::getInstance()->Parse();

I have looked through the class but cannot relate the Lighthouse Result to the code. Could you be so kind to provide a brief hint or tip.

Thank you in advance, very much appreciated.

Chrome users have 'unsafe-inline' added to style-src directive for the automatic google translating of webpages to keep working. 'unsafe-inline' is unsafe and should not be added if automatic translating of webpages can work without it.