title: Define CSP HTTP Header in Electron App
body: <p>Following <a href="https://electronjs.org/docs/tutorial/security#csp-http-header" rel="noreferrer">the API documentation</a>, I don't understand how to define a Content-Security-Policy HTTP Header for the renderer of my Electron application. I always get a warning in the DevTools.</p>
  
  <p>I tried:</p>
  
  <p>1) Copy/Paste the code in the API Doc, blindly:</p>
  
  <pre><code>app.on('ready', () =&gt; {
      const {session} = require('electron')
      session.defaultSession.webRequest.onHeadersReceived((details, callback) =&gt; {
          callback({responseHeaders: `default-src 'self'`})
      })
  
      win = new BrowserWindow(...)
      win.loadUrl(...)
  }
  </code></pre>
  
  <p>(By the way, I don't get why "Content-Security-Policy:" is missing in the string. But adding it don't change anything)</p>
  
  <p>2) Modifying the session of the renderer with the same code:</p>
  
  <pre><code>win = new BrowserWindow(...)
  win.loadUrl(...)
  
  const ses = win.webContents.session;
  ses.webRequest.onHeadersReceived((details, callback) =&gt; {
    callback({responseHeaders: `default-src 'self'`})
  })
  </code></pre>
  
  <p>3) Add an extra header to ther renderer:</p>
  
  <pre><code>win = new BrowserWindow(...)
  win.loadURL(`file://${__dirname}/renderer.html`,{
      extraHeaders: `Content-Security-Policy: default-src 'self'`
  });
  </code></pre>
  
  <p>...</p>
  
  <p>The only thing that works is using a meta tag in the renderer HTML file:</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self'&gt;
  </code></pre>