Revision history [back]

You can use a Content Security Policy (CSP) script-src directive to allow only trusted sources of scripts to be loaded into your web page. To incorporate a script from a retrieved source while maintaining CSP enforcement, you need to ensure that the source of the script is explicitly allowed in the script-src directive of your CSP.

1. Update your CSP policy to allow the source of the script. For example, if you want to include a script from https://example.com/script.js, you can update your CSP policy as follows:

Content-Security-Policy: script-src 'self' https://example.com;

This CSP policy allows scripts from your website ('self') and https://example.com.

1. Add the script to your web page using a script tag.

<script src="https://example.com/script.js"></script>

1. Test your website to ensure that the script is working and that CSP enforcement is not compromised.

By adding the source of the script to your CSP policy, you can ensure that only trusted scripts can be loaded into your web page. This helps to protect your website from cross-site scripting (XSS) attacks and other security threats.