The best way to deal with CSP is to never allow a CSP directive in your HTML or response headers. It's one of the worst, most confused, harmful specifications

The best way to deal with CSP is to never allow a CSP directive in your HTML or response headers. It's one of the worst, most confused, harmful specifications in the collection of modern Web standards. At the very least, anyone who isn't on the security team at an org should be forbidden from touching anything related to CSP. (If the org isn't big or organized enough to have a security team, that would be a set of size 0. Seriously, don't use it.)