We need to add a Content Security Policy to our application that adheres to the following requirements:
- include a 'default-src' directive to act as a fallback for other resource types when their policy definitions are absent
- set explicit CSP 'script-src' and 'style-src' directives, without the use of wildcard domains
- not utilize any 'unsafe'- prefixed directives.
Reading through this article in Intercom Help, i think point#2 above can be addressed (but please confirm), and also advise if points #1 and #3 can work with Intercom (e.g. can we avoid using the 'unsafe-inline'?)
Best answer by ShaunaView original