I've just updated my site with setting my Content-Security-Policy Header and after fixing the slew of errors which popped up in the console, I am now down to one.
The relevant part of my .htaccess file is
script-src 'self'. Here I do not set
'unsafe-inline' as that kind of goes against the point of setting the CSP in the first place - at least in my reading.
With Craft setting a CSRF token and my site doing POST requests over AJAX, I set the token name and value as recommended here: https://craftcms.com/support/csrf-protection - which is inline and above in my CSP I do not allow inline scripts. So as you can see it falls apart and Craft spits out a 400 error.
Is there any way I can get around this? I'd like to keep my CSP and with CSRF being enabled by default in Craft 3, I'd like this ironed out before then.