CSP warnings in real operation

[sleidig]

After deploying the CSP (report-only), some content is still triggering warnings and not properly whitelisted in our default CSP:

• Refused to load the image 'blob:URL'
• Fetch API cannot load https://o167951.ingest.sentry.io/api/1242399/security/. Request mode is "no-cors" but the redirect mode is not "follow".

[TheSlimvReal]

One problem is that the index.html script hash has not been correctly updated. How can this be done?

[sleidig]

I documented this here in den Developer Docs "Security" Concept (happy for suggestions about a better place): https://aam-digital.github.io/ndb-core/documentation/additional-documentation/concepts/security.html

[TheSlimvReal]

The instructions dont seem to work on all browsers (this is from Chrome on Mac, Safari seems to show even less info)