title: Content Security Policy: "The page's settings blocked the loading of a resource at self..." vs AJAX/jquery
body: <p>To increase security for my current project I started to implement the page with the following CSP:</p>
  
  <pre><code>    Content-Security-Policy: default-src 'none'; 
      connect-src 'self'; img-src 'self'; object-src 'none'; 
      script-src 'self' https://www.googletagmanager.com 
      https://notifications.google.com; style-src 'self' 'unsafe-inline';
      font-src https://fonts.googleapis.com https://fonts.gstatic.com/; 
      base-uri 'self'; frame-ancestors 'self'; form-action 'self';
  </code></pre>
  
  <p>It works fine including the parts loaded with AJAX/jquery except for one script where the loaded content looks like this:</p>
  
  <pre><code>    &lt;div&gt;content&lt;/div&gt;
      &lt;script src="ganalyse.js"&gt;&lt;/script&gt;
  </code></pre>
  
  <p>I'd expect the browser to load the linked javascript, as the file is on the same server and should be included by the 'self' declaration, but instead the browser console logs an error (<a href="https://i.stack.imgur.com/aiXKa.png" rel="nofollow noreferrer">Console log (German)</a>):</p>
  
  <pre><code>    Content Security Policy: The page's settings blocked the loading of
      a resource at self...
  </code></pre>
  
  <p>In order to exlude an error in the linked js-File, it currently only consists of an alert. Anyone an idea what i should change to get this to work? 
  $.getScript() gets me the same error...</p>
  
  <p>EDIT:</p>
  
  <p>A  tag loaded over AJAX or with $.getScript() seems to get handled as if it was inline code (working only when "unsafe-inline" is activated). As of now I will try to build a workaround</p>