&gt; Maybe you could whitelist the subdomains only.<p><a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;csp-by-api" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;csp-by-api</a> can help with that: it contains CSPs for popular APIs so you can just add the the APIs you&#x27;re using to your own CSP:<p><pre><code>    var policy = cspByAPI(basePolicy, [&#x27;twitter&#x27;, &#x27;mixpanel&#x27;, &#x27;googleFonts&#x27;, &#x27;stripe&#x27;, &#x27;typekit&#x27;, &#x27;ractive&#x27;])</code></pre>