CSP for C3.js: Common Mistakes and Fixes
C3.js is handy because it gets you from raw data to charts fast. It’s also one of those libraries that tends to expose every weak spot in a sloppy Content Security Policy. I’ve seen teams lock down CSP, deploy C3.js, and then spend an afternoon wondering why the chart container stays blank while the console screams about blocked scripts or styles. Usually the breakage isn’t C3 itself. It’s the mix of D3, inline config, CDN habits, and CSS assumptions. ...