> I suspect react doesn’t support the policies well Frankly this sounds like something you just made up. Why would React require any weakening of CSP rules? I

> I suspect react doesn’t support the policies well Frankly this sounds like something you just made up. Why would React require any weakening of CSP rules? Is there something special about React that requires loading it differently than any other JavaScript? On the whole, React is a win for security, because XSS is by default impossible, due to the indirection provided by the Virtual DOM abstraction. As long as you (and your dependencies) don’t dangerouslySetInnerHTML, you’ll eliminate most XSS bugs.