For all defined external sites, your web server should have a way of establishing specific Content-Security-Policy headers to allow those sites.
For all defined external sites, your web server should have a way of establishing specific Content-Security-Policy headers to allow those sites.