Probably the least know security mechanism, even more arcane than CORS. It might conflict with heavy CDN usage, but it certainly should be defined for producti

Probably the least know security mechanism, even more arcane than CORS. It might conflict with heavy CDN usage, but it certainly should be defined for production use. Don't really know exactly how browsers use it currently. I think it works as a deny-all as soon as anything is defined with exceptions for the named resources. Otherwise an 'allow all' security policy would look like this: default-src * 'unsafe-inline' 'unsafe-eval' data: blob; I think that would be worse than not having any, because browsers use some "sensible" default policies against XSS in case nothing is defined.