Q:

Header CSP (content-security-policy) not correct

I am having issues with my websites javascript, on the main page the dropdown box in bootstrap will not work, however on a sub-directory it seems to work perfectly fine... my CSP header is as follows:
script-src 'self' //ajax.cloudflare.com

From my understanding of the CSP documentation; spaces will allow for more than one entry in a directive. "script-src"
What I don't get is why it doesn't work on the main page. I'm at a loss here.
error:
index.php:10 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' //ajax.cloudflare.com". Either the 'unsafe-inline' keyword, a hash ('sha256-safag'), or a nonce ('nonce-...') is required to enable inline execution.

A:

Fixed with:
$cspheader = "'default-src':'none' 'script-src':'self' 'unsafe-eval' //ajax.cloudflare.com/'font-src': 'self' 'connect-src':'self' 'img-src':'self' 'style-src':'self' 'media-src':'self'";
 header("Content-Security-Policy: ". $cspheader);

