Loading AddToAny with a content security policy in .htaccess

The module already loads AddToAny using HTTPS.

AddToAny is secure by default and HSTS preloaded in browsers to ensure it loads over HTTPS only.

Sure, there is a saying and there is a motivation for this post discussion!
Could you kindly have a look at the supporting evidence attached to this post.
The screenshot of content security policy section of browser which proves an issue of loading in-secure content.

How are you implementing your CSP?

The report in the screenshot is erroneously showing http: for some reason. What tool is that report from?

AddToAny has general guidance on working with a strict CSP where a nonce is the recommended usage:
https://www.addtoany.com/buttons/faq/#content-security-policy

In the Drupal ecosystem it seems that nonces aren't straightforward to implement yet ( csp module → , seckit module ✨ Implement a "semi automatic" Nonce settings Needs work ), so you'll probably want to include https://*.addtoany.com in an allowlist to generate something like the following HTML meta tag:

<meta http-equiv="Content-Security-Policy"
  content="default-src 'unsafe-inline' https://*.addtoany.com https://*.pinterest.com; img-src 'self' data:">

Well, Well, Well. Content security policy is inserted in htaccess at the root level. This approach helps with minimizing load request, centralizing security controls, and downsizing maintenance tasks, in comparison with adding meta tags to all pages via a third-party module or directly in theme files.

How are you implementing your CSP?

The backing evidence provided by Opera and if you are thinking of a false positive please feel free to set it up and reproduce the result. It is expected from the module to request all the content from a secure channel, no matter the security implementation approach of a site is? How do you agree on this?

Since the site isn't using nonces, the CSP header needs to be updated to explicitly allow domains such as https://*.addtoany.com (and https://*.pinterest.com if Pinterest is wanted).

In .htaccess it should look something like:

Header add Content-Security-Policy "default-src 'unsafe-inline' https://*.addtoany.com https://*.pinterest.com; img-src 'self' data:;"

See #3339782-6: Loading AddToAny with a content security policy in .htaccess → for guidance.