CSP is a Candidate Recommendation of the W3C working group on Web Application Security. The framework uses the Content-Security-Policy HTTP header recommended by the W3C.
The framework’s CSP covers these resources:
You can change the CSP policy and expand access to third-party resources by adding CSP Trusted Sites.
CSP isn’t enforced by all browsers. For a list of browsers that enforce CSP, see caniuse.com.
Any policy violations are logged in the browser’s developer console. The violations look like the following message.
Refused to load the script 'https://externaljs.docsample.com/externalLib.js' because it violates the following Content Security Policy directive: ...
If your app’s functionality isn’t affected, you can ignore the CSP violation.