title: How to safely combine script-src with known JSONP endpoint hosters like syndication.twimg.com?
body: <p>I'm playing with Content Security Policy for a page with embedded tweets and I'm getting reports for <code>https:/​/​cdn.syndication.twimg.com</code>, which isn't allowed in my policy.</p>
  
  <p>It's a pretty long policy but the relevant parts are</p>
  
  <pre><code>default-src 'none'; ... script-src 'self' apis.google.com platform.twitter.com; ...
  </code></pre>
  
  <p>However, if I add <code>cdn.syndication.twimg.com</code> or <code>*.twimg.com</code> to the <code>script-src</code> part of the header, I get a warning when I run the header through the <a href="https://csp-evaluator.withgoogle.com/" rel="nofollow noreferrer">Google CSP evaluator</a>:</p>
  
  <blockquote>
    <p><code>cdn.syndication.twimg.com</code> is known to host JSONP endpoints which allow to bypass this CSP.</p>
  </blockquote>
  
  <p>Some other domains also provoke this warning.</p>
  
  <p>It seems that I'm between a rock and a hard place: either I disallow Twitter from running scripts (needed? I really don't know) and get policy violation reports, or I'm running with a pretty much useless CSP.</p>
  
  <p>Is there a way out of this conundrum?</p>