CSP for Turret CSS: Common Mistakes and Fixes
Turret CSS is just CSS, so on paper CSP should be easy: allow your stylesheet, block the weird stuff, move on. In practice, teams still break production layouts with CSP all the time. I’ve seen the same pattern over and over: someone tightens style-src, the app ships, and suddenly Turret CSS “doesn’t work.” Usually Turret isn’t the problem. The policy is. More specifically, the policy was written with JavaScript in mind and nobody checked how styles are actually loaded, injected, or modified across the app. ...