Domains added to script-src and style-src by libraries also need to be included in the corresponding *-src-elem directives. Otherwise, the *-elem directive could be incorrectly more restrictive in supporting browsers.
Policy optimization should remove the *src-elem directive if it is the same as it's corresponding *-src directive and can safely fallback.
Comments
Comment #3
gapple