Restrictive default-src

A permissive or missing default-src directive means every resource type without an explicit CSP directive — fonts, media, frames, workers, manifests — defaults to unrestricted loading. An attacker who achieves any injection can load arbitrary resources from any origin using these unguarded resource types, side-stepping the protections you applied to script-src. CWE-79 and CWE-693 both apply here. OWASP A03 identifies missing fallback directives as a common CSP misconfiguration that leaves partial protection in place while creating exploitable gaps in less-obvious resource categories.

Set default-src to 'none' or 'self' as the first directive, then add specific source directives only for resource types your application actually uses.

# Start from none and add specific overrides
Content-Security-Policy:
  default-src 'none';
  script-src 'self' 'nonce-{perRequest}' 'strict-dynamic';
  style-src 'self';
  img-src 'self' data:;
  font-src 'self';
  connect-src 'self' https://api.yourdomain.com;
  frame-ancestors 'none'

Prefer 'none' for maximum restriction — add back only the categories your app needs. This approach forces you to be explicit about every resource type rather than inheriting broad defaults.