title: CSP for dynamically loaded CSS
body: <p>So I'm loading a JavaScript file from a third party into my application which injects an iframe onto the page. When that iframe loads, it loads its own JavaScript which creates an inline style tag in the parent window. </p>
  
  <p>Because of this flow, I have to have <code>"unsafe-inline"</code> in my content security policy for the <code>style-src</code> directive. Is there anything like <code>strict-dynamic</code> that would work for styles loaded like this? Or is there some kind of solution in which I don't have to have <code>"unsafe-inline"</code> listed in my CSP that still allows this one stylesheet? </p>
  
  <p>Best I can come up with is to scan this redirected file every couple of hours and generate subresource integrity hashes for it to inject into my CSP on a regular basis, but this seems really fragile.</p>