[v5] CSP config for 'self' is broken?

[bjornarhagen]

Hello!
So I've followed the docs on how to setup the adonisjs/shield package. I've got CSRF working, and now I'm looking into CSP.
It seems the configuration is broken, or maybe I'm just using it wrong? Any help here would be greatly appreciated.

Here is the config:

export const csp: ShieldConfig['csp'] = {
    enabled: true,
    directives: {
        defaultSrc: ['self']
    }
}

From my understanding of CSP, this should allow all resources to load as long as it's from the same origin.
Howoever, with this setup everything gets blocked.

Looking at the network tab in my dev tools, I can see the request header contains this:

Content-Security-Policy: default-src self

Looking at the docs for CSP, self should be wrapped in single qoutes, like so:

Content-Security-Policy: default-src 'self'

If I change to defaultSrc: ["'self'"] it works, but is this how it should work? If so maybe the Adonis docs should be updated to reflect this.

[thetutlage]

Yup. Docs needs to be fixed here. Can you please create a PR for the same?

[bjornarhagen]

Ok, here you go adonisjs/v5-docs#76 :)