<?php
    return [
        'response' => [
            'header' => [
                'X-XSS-Protection' => '1; mode=block',
                'X-Content-Type-Options' => 'nosniff',
                'Content-Security-Policy' => "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' https://* data: blob:; font-src 'self' data:;",
                'Set-Cookie' => true,
            ]
        ]
    ];