how to configure CSP correctly

There's no app.php in config !

There is it, in CodeIgniter 4, can anybody help with V3?
Thanks!

Yeah, CI 3 does not have built-in support for Content Security Policy (CSP), but CSP is just HTTP header.

1. You are able to publish any HTTP headers in any version of CodeIgniter by use $response->setHeader() method:

Code:

$this->response->setHeader('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inine';");

2. If you are not looking for easy ways and wish to have some convenience of CSP setup, it's possible to import class ContentSecurityPolicy.php from CI4 to CI3. You just need to change some PHP7 constructs like:

PHP Code:

$explicitReporting ?? $this->reportOnly 


 to PHP5:

PHP Code:

is_null($explicitReporting)  ? $this->reportOnly : $explicitReporting 


Anyway you need to modify class ContentSecurityPolicy.php even if you use CI4 - this class is oriented outdated Content Security Policy level 2 spec,, therefore it does not support a lot of CSP3 directives and tokens.