Sobelow still reports an issue

[mplatts]

Using the plug ContentSecurityPolicy.Plug.Setup was causing Sobelow to still complain.

So I did this to fix it:

@content_security_policy %ContentSecurityPolicy.Policy{
    default_src: [
      "'unsafe-inline'",
      "'unsafe-eval'",
      "'self'",
      "https://cdnjs.cloudflare.com",
      "https://cdn.skypack.dev",
      "https://res.cloudinary.com"
    ]
  }

pipeline :browser do
  ...
  plug(:put_secure_browser_headers, %{"content-security-policy" => ContentSecurityPolicy.serialize(@content_security_policy)})
  ...
end

Not sure if there is a better way?

[rellen]

you could set the option to %{"content-security-policy" => ""} then put the plug after, but I'm not sure if that counts as better :)