I think browsers should make a distinction between server-provided scripts and local-user-initiated scripts. From what I can tell, CSP should only apply to ser

I think browsers should make a distinction between server-provided scripts and local-user-initiated scripts. From what I can tell, CSP should only apply to server-provided scripts. They are a way for the server to restrict the capabilities of its own scripts. “I only require resources from these domains. If you hear otherwise, it wasn’t from me.” For local-user-initiated scripts, this restriction is unnecessary. The server has limited what scripts it itself can run, but that shouldn’t impact what scripts the user can run.