Directives

compose your policy

Content-Security-Policy 

default-src 'self'; object-src 'none'; base-uri 'self'

report-uri tester

fires from your browser