Using Content Security Policy in AMP-HTML pages?

Question

I have a site built with AMP. I tried to use Content-Security-Policy: script-src 'self', but all styles and designs didn't show properly since they are loaded from cdn.ampproject.org. Google, in their AMP documentation, says that all Content Security Policy has been handled before stored in their repository.

Is there a solution?

Answer 1

Finally, I found this on scotthelme.co.uk. Here's the script:

<?php
header('Content-Security-Policy: script-src https://cdn.ampproject.org:*');
?>

And, it works as I wish when I check it on securityheaders.io.