I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications into their pages, or script kiddies in a coffee shop turning the developer's normally harmless code into an ad hoc attack site. My first thought was the Content Security Policy header, but I am now unsure.
It is my understanding that unencrypted http traffic, including the headers, can be modified by a malicious third party performing a man-in-the-middle attack.
If this is the case, then the Content Security Policy header would be vulnerable to modification or deletion. The attacker could then insert, and have the browser execute, whatever they wanted.
Does it then give the developer a false sense of security in being able to include a CSP on an unencrypted page without some sort of warning in the browser console about MiTM, or are the good reasons for including it enough to outweigh this?