header('Referrer-Policy: strict-origin-when-cross-origin'); $headerCSP = "Content-Security-Policy: ". "default-src 'self'; base-uri 'self'; object-src 'none'; ". "frame-src 'self' player.vimeo.com *.youtube.com youtube.com; ". "style-src 'self' 'unsafe-inline' *.kakaocdn.net *.typekit.net *.dit.ac.kr *.daumcdn.net t1.daumcdn.net *.googleapis.com *.gstatic.com *.github.io; ". "font-src 'self' data: *.typekit.net *.gstatic.com *.jsdelivr.net; ". "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.typekit.net *.typekit.com *.daumcdn.net *.daum.net *.kakao.com *.kakaocdn.net *.naver.net *.naver.com *.pstatic.net *.gstatic.com *.googleapis.com *.google.com *.vimeocdn.com *.dit.ac.kr *.jsdelivr.net cdnjs.cloudflare.com; ". "img-src 'self' data: *.typekit.net *.daumcdn.net *.daum.net *.pstatic.net *.gstatic.com *.google.com *.kakao.com *.github.io *.jsdelivr.net *.dit.ac.kr www.google-analytics.com *.ytimg.com i.ytimg.com *.youtube.com *.cdninstagram.com *.kakaocdn.net; ". "connect-src 'self' *.dit.ac.kr www.google-analytics.com dapi.kakao.com unv.doculink.co.kr *.google.com *.googleapis.com *.typekit.net *.naver.com *.kakao.com; ". "frame-ancestors 'self';"; header($headerCSP); ?>








