It can be simplified, but it would reduce its usefulness to include wild cards. By specifying paths more explicitly, I whitelist less of the domain (and conseq

It can be simplified, but it would reduce its usefulness to include wild cards. By specifying paths more explicitly, I whitelist less of the domain (and consequently reduce the chances that I'll whitelist something this is user controllable in the domain). I'll usually try to allow down to specific files in CSP if I can. Hosting font awesome myself costs me money, pointing to cloudflare is free Edit: check out my site vs. a few others using Google's CSP evaluator – you'll probably find a lot with known CSP bypasses due to their whitelisting.