My static site had a deliberately tight Content-Security-Policy: default-src 'self' , a short allowlist for analytics, nothing else. Then I added an ad network, and hit the obvious wall. Ad creatives come from domains you cannot enumerate ahead of time.
Source: [Dev.to](https://dev.to/hblai_filmlook/running-third-party-ads-on-a-site-with-a-strict-csp-without-weakening-the-csp-33l2)