tl;dr
The
strict-dynamicsource list keyword allows you to simplify your CSP policy by favoring hashes and nonces over domain host lists.The key super power of
strict-dynamicis that it will allow to load additional scripts via non-"parser-inserted" script elements.
For unsupported browsers Show archive.org snapshot , your script can be made backwards compatible by doing something like this:
script-src 'nonce-rAnd0m' 'strict-dynamic' https: 'self'
default-src 'self';
With 'strict-dynamic' the https: entry will be ignored by modern browsers. Older browsers will allow the loading of scripts from any URL.
Does not affect CSS or Images
img-src and style-src directives still apply.
Read further
A good default CSP can be found at Strict CSP Show archive.org snapshot .
Posted by Julian to makandra dev (2023-05-24 14:59)