appName, $devMode ? 'dev-mode' : 'main', [ ] ); $csp = new ContentSecurityPolicy(); $csp->addAllowedImageDomain('*'); $response->setContentSecurityPolicy($csp); return $response; } }