nelmio_security:
    clickjacking:
        paths:
            '^/.*': SAMEORIGIN # FancyBox is sometimes used with and iframe
    content_type:
        nosniff: true
    csp:
        report_logger_service: monolog.logger.security
        enforce:
            # see full description below
            level1_fallback: true
            # Only send directives supported by the browser, defaults to false
            # This is a port of https://github.com/twitter/secureheaders/blob/83a564a235c8be1a8a3901373dbc769da32f6ed7/lib/secure_headers/headers/policy_management.rb#L97
            browser_adaptive:
                enabled: false
            report-uri: '%router.request_context.base_url%/csp/report'
            connect-src:
                - 'self'
            default-src:
                - 'self'
                - 'gse.google.com' # Google Custom Search Engine
                - '*.ytimg.com' # Video 
                - '*.googletagservices.com'
                - '*.youtube.com'
                - 'cdn.matomo.cloud'
                - 'maps.googleapis.com'
                - 'www.google.com'
            font-src:
                - 'self'
                - 'fonts.gstatic.com' #Google maps
                - 'www.tinymce.com'
                - '*.googletagservices.com'
                - '*.youtube.com'
            child-src:
                - 'self'
                - '*.google.com' # Google Custom Search Engine, Google Recaptcha
                - 'www.youtube.com' # Embedded videos
                - 'www.youtube-nocookie.com' # Embedded videos
                - '*.ytimg.com' # Video 
                - '*.youtube.com'
                - 'cdn.matomo.cloud'
                - 'maps.googleapis.com'
                - 'www.google.com'
            img-src:
                - 'self'
                - 'data:' # Allows data: URIs to be used as a content source (@see https://developer.mozilla.org/fr/docs/Web/Security/CSP/CSP_policy_directives#Data) 
                - '*.google.com' # Google Custom Search Engine
                - 'www.google-analytics.com'
                - 'ssl.google-analytics.com'
                - '*.googleapis.com' # Google maps, Google Custom Search Engine
                - '*.gstatic.com' # Google maps, Google Recaptcha
                - 'i1.ytimg.com' # Video 
                - '*.ytimg.com' # Video 
                - '*.googletagservices.com'
                - 'www.googletagmanager.com'
                - '*.youtube.com'
            frame-src:
                - 'self'
                - 'www.youtube.com'
                - 'www.youtube-nocookie.com'
                - '*.ytimg.com' # Video 
                - '*.google.com' # Google Custom Search Engine
                - '*.googletagservices.com'
                - 'www.youtube.com'
                - 'cdn.matomo.cloud'
                - 'maps.googleapis.com'
                - 'www.google.com'
            script-src:
                - 'self'
                - 'unsafe-eval' # Google Custom Search Engine
                - 'unsafe-inline' # Bad JavaScript implementation :/
                - '*.google.com'
                - 'www.google-analytics.com'
                - 'www.googletagmanager.com'
                - '*.googleapis.com' # Google maps, Google Custom Search Engine
                - '*.gstatic.com' # Google maps, Google Recaptcha
                - 'static.doubleclick.net' # Google analytics
                - 'www.youtube.com' # Youtube
                - 'www.googletagservices.com'
                - 's.ytimg.com'
                - 'cdn.matomo.cloud'
                - 'maps.googleapis.com'
                - 'www.google.com'
            style-src:
                - 'self'
                - 'unsafe-inline' # FancyBox Javascript library
                - 'www.google.com'
                - '*.gstatic.com' # Google maps, Google Recaptcha
                - 'fonts.googleapis.com' #Google maps
                - 'www.youtube.com' # Embedded videos
                - 'www.googletagmanager.com'
                - '*.googletagservices.com'
                - '*.youtube.com'
            block-all-mixed-content: false  # Default to false, blocks http content over https transport
            # upgrade-insecure-requests: true # Default to false, upgrades http requests to https transport
    xss_protection:
        enabled: true
        mode_block: true
