@@ -66,7 +66,9 @@ call basis, by providing an optional second parameter to the adding method call.
66
66
Runtime Configuration
67
67
*********************
68
68
69
- If your application needs to make changes at run-time, you can access the instance at ``$this->response->getCSP() `` in your controllers. The
69
+ If your application needs to make changes at run-time, you can access the instance at ``$this->response->getCSP() `` in your controllers.
70
+
71
+ The
70
72
class holds a number of methods that map pretty clearly to the appropriate header value that you need to set.
71
73
Examples are shown below, with different combinations of parameters, though all accept either a directive
72
74
name or an array of them:
@@ -76,12 +78,27 @@ name or an array of them:
76
78
The first parameter to each of the "add" methods is an appropriate string value,
77
79
or an array of them.
78
80
81
+ Report Only
82
+ ===========
83
+
79
84
The ``reportOnly() `` method allows you to specify the default reporting treatment
80
- for subsequent sources, unless over-ridden. For instance, you could specify
85
+ for subsequent sources, unless over-ridden.
86
+
87
+ For instance, you could specify
81
88
that youtube.com was allowed, and then provide several allowed but reported sources:
82
89
83
90
.. literalinclude :: csp/013.php
84
91
92
+ .. _csp-clear-directives :
93
+
94
+ Clear Directives
95
+ ================
96
+
97
+ If you want to clear existing CSP directives, you can use the ``clearDirective() ``
98
+ method:
99
+
100
+ .. literalinclude :: csp/014.php
101
+
85
102
**************
86
103
Inline Content
87
104
**************
0 commit comments