Implemented a Content-Security-Policy which disallows external and inline scripts

config/routes.yaml

@@ -8,6 +8,12 @@ scan_qr:
     path: /scan/{type}/{id}
     controller: App\Controller\ScanController:scanQRCode
 
+csp_report:
+    path: /csp/report
+    methods: [POST]
+    defaults: { _controller: nelmio_security.csp_reporter_controller::indexAction }
+
+# Must be last as it matches everything
 redirector:
     path: /{url}
     requirements: