title: Content Security Policy contains an invalid source
body: <p>I'm trying to use Content Security Policy on my site, I've already done everything right, and everything works, but this error still appears in the console</p>
  <blockquote>
  <p>The source list for the Content Security Policy directive 'default-src' contains an invalid source: 'data:frame-src'. It will be ignored.</p>
  </blockquote>
  <p>Where did I go wrong? What's wrong here?</p>
  <pre><code>&lt;?php
  
  namespace App\Http\Middleware;
  
  use Closure;
  use Illuminate\Http\Request;
  
  class ContentSecurityPolicy
  {
      public $resources = [
          'default-src' =&gt; [
              &quot;'self'&quot;,
              &quot;'unsafe-inline'&quot;,
              'cdn.jsdelivr.net',
              '*.googletagmanager.com',
              'fonts.googleapis.com',
              'cdnjs.cloudflare.com',
              'fonts.gstatic.com',
              'code.jquery.com',
          ],
          'img-src' =&gt; [
              &quot;data:&quot;,
          ],
          'frame-src' =&gt; [
              'youtube.com www.youtube.com',
          ],
      ];
  
      public function handle(Request $request, Closure $next)
      {
          $response = $next($request);
  
          $contentSecurityPolicy = '';
          foreach ($this-&gt;resources as $key =&gt; $values) {
              $contentSecurityPolicy .= $key . ' ' . implode(' ', $values);
          }
  
          $response-&gt;header(&quot;Content-Security-Policy&quot;, $contentSecurityPolicy);
  
          return $response;
      }
  }
  </code></pre>
  <p>There is also another error</p>
  <blockquote>
  <p>Refused to load the image 'https://ssl.gstatic.com/ui/v1/icons/mail/images/2/openhand.cur' because it violates the following Content Security Policy directive: &quot;default-src 'self' 'unsafe-inline' cdn.jsdelivr.net *.googletagmanager.com fonts.googleapis.com cdnjs.cloudflare.com fonts.gstatic.com code.jquery.comimg-src data:frame-src youtube.com www.youtube.com&quot;. Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.</p>
  </blockquote>