title: Required CSP rules for Facebook login
body: <p>Which are the required rules to allow a Facebook login?</p>
  
  <p>I currently allow these:</p>
  
  <pre><code>defaultSrc: ["'self'",
          '*.facebook.com',
          '*.akamaihd.net'],
          scriptSrc: ["'self'",
           '*.facebook.com',
           '*.akamaihd.net',
           "'unsafe-inline'",
           "'unsafe-eval'"],
          frameSrc: [
          "'self'",
          '*.facebook.com',
          '*.akamaihd.net',
          styleSrc: ["'self'",
           "'unsafe-inline'"],
          imgSrc: ["'self'",
          '*.akamaihd.net',
          '*.facebook.com']
  </code></pre>