harden CSP policies further

Open

#2,665 opened on Aug 14, 2019 3 comments 0 reactions 0 assignees View on GitHub

Type: enhancement

Description

Check: https://csp-evaluator.withgoogle.com
It seems it's not enough to trust specific domains.

We should probably use:
* `hash`, and,
* `strict-dynamic`
* `block-all-mixed-content`

This issue has not been assessed yet.