}
/**
- * Get the CSP headers for the application
+ * Get the CSP headers for the application.
*/
public function getCspHeader(): string
{
{
$iframeHosts = $this->getAllowedIframeHosts();
array_unshift($iframeHosts, "'self'");
+
return 'frame-ancestors ' . implode(' ', $iframeHosts);
}
{
$iframeHosts = $this->getAllowedIframeSources();
array_unshift($iframeHosts, "'self'");
+
return 'frame-src ' . implode(' ', $iframeHosts);
}
protected function getAllowedIframeHosts(): array
{
- $hosts = config('app.iframe_hosts', '');
+ $hosts = config('app.iframe_hosts') ?? '';
return array_filter(explode(' ', $hosts));
}