On the Brittleness of Content Security Policy

I explored the possibility of employing Content Security Policy for this very blog. I succeeded in enforcing a couple of URL whitelists. But that showed that whenever the referring websites change anything on their end, I am cooked. Below is an NGINX configuration to allow for JavaScript libraries like MathJax DataTables TikTok WordPress CodePen Ahrefs Analystics X/Twitter add_header…