My takeaway from this is to use CSP to minimize your reliance on others doing things intelligently. And that Datadog is not doing things intelligently at the inconvenience of their consumers.
Unfortunately, retrofitting CSP on an existing site can be nightmare, especially if you have external dependencies. At my job, we spent months trying to enable CSP on one our oldest sites, but ultimately gave up because one of our dependencies won’t work unless we added “unsafe-inline” everywhere, which kinda defeats the whole point of CSP.
My takeaway from this is to use CSP to minimize your reliance on others doing things intelligently. And that Datadog is not doing things intelligently at the inconvenience of their consumers.
https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
Unfortunately, retrofitting CSP on an existing site can be nightmare, especially if you have external dependencies. At my job, we spent months trying to enable CSP on one our oldest sites, but ultimately gave up because one of our dependencies won’t work unless we added “unsafe-inline” everywhere, which kinda defeats the whole point of CSP.
Having something is better than nothing! In our case, having
connect-srcenabled would have avoided the incident.