CSP Mistakes With Font Awesome Icons and Fixes
Font Awesome is one of those libraries that looks harmless until CSP gets involved. Then suddenly half your icons disappear, the browser starts shouting about blocked fonts or styles, and somebody suggests adding https: everywhere until the warnings stop. That usually “works,” but it also guts your policy. If you’re using Font Awesome with a Content Security Policy, the failures usually come from a few predictable mistakes: allowing the CSS but not the font files allowing the kit script but not the injected styles self-hosting some assets and loading others from a CDN relying on default-src and assuming it covers everything you need fixing breakage with unsafe-inline when the real problem is somewhere else Here’s what goes wrong and how I’d fix it. ...