tl;dr

The strict-dynamic source list keyword allows you to simplify your CSP policy by favoring hashes and nonces over domain host lists.

The key super power of strict-dynamic is that it will allow to load additional scripts via non-"parser-inserted" script elements.

For unsupported browsers Show archive.org snapshot , your script can be made backwards compatible by doing something like this:

script-src 'nonce-rAnd0m' 'strict-dynamic' https: 'self'
default-src 'self';

Rails Long Term Support

Rails LTS provides security patches for old versions of Ruby on Rails (2.3, 3.2, 4.2 and 5.2)

• Prevents you from data breaches and liability risks
• Upgrade at your own pace
• Works with modern Rubies

Read more Show archive.org snapshot

With 'strict-dynamic' the https: entry will be ignored by modern browsers. Older browsers will allow the loading of scripts from any URL.

Does not affect CSS or Images

img-src and style-src directives still apply.

Read further

A good default CSP can be found at Strict CSP Show archive.org snapshot .