So in a CSP like the below:
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com
Should the url part be quoted like this (example from mozilla security ) - even though this example has both styles:
# Disable unsafe inline/eval and plugins, only load scripts and stylesheets from same origin, fonts from google, # and images from same origin and imgur. Sites should aim for policies like this. Content-Security-Policy: default-src 'none'; font-src 'https://fonts.googleapis.com'; img-src 'self' https://i.imgur.com; object-src 'none'; script-src 'self'; style-src 'self'
Or unquoted like this:
# Disable unsafe inline/eval, only load resources from same origin except also allow images from imgur # Also disables the execution of plugins Content-Security-Policy: default-src 'self'; img-src 'self' https://i.imgur.com; object-src 'none'
 Examples from here: https://infosec.mozilla.org/guidelines/web_security#content-security-policy