After finding a couple of suspicious files on our web sever I've been working to try and find ways to tighten up the security. I'm looking at trying to configure a Content Security Policy.
I'm already using the Security Kit module 7.x-1.11 for Drupal to enforce HTTPS, so I've enabled its built in CSP features as well. To it running fine in reports only mode I've had to allow unsafe-inline for style and script, which isn't ideal, but I figure it's better than nothing.
Turning off reports only works fine for our Drupal site, but as soon as I do that CiviCRM isn't displaying correctly. I have console errors that say things like:
Obviously I could add unsafe-eval on scripts, but at that point it seems like the CSP is barely worth having. Is there a safe way of configuring CSP that works with Drupal 7/CiviCRM?