strapi/examples/getstarted/config/environments/development/security.json

{
  "csp": {
    "enabled": true,
    "policy": [
      {
        "img-src": "'self' http: data:"
      },
      "block-all-mixed-content"
    ]
  },
  "p3p": {
    "enabled": false,
    "value": ""
  },
  "hsts": {
    "enabled": true,
    "maxAge": 31536000,
    "includeSubDomains": true
  },
  "xframe": {
    "enabled": true,
    "value": "SAMEORIGIN"
  },
  "xss": {
    "enabled": true,
    "mode": "block"
  },
  "cors": {
    "enabled": true
  },
  "ip": {
    "enabled": false,
    "whiteList": [],
    "blackList": []
  }
}