Why SRI must not be used for page.js + how to load AddToAny with a CSP

Definitely do not use SRI on page.js — that evergreen file receives important updates and SRI will break it on the very next update.

For site security AddToAny supports a strict content security policy (CSP) with nonces; however, nonces aren't currently straightforward to implement in Drupal ( csp module issue → , seckit module issue ✨ Implement a "semi automatic" Nonce settings Needs work ), so it's a good idea to explicitly allow specific domains in .htaccess like:

Header add Content-Security-Policy "default-src 'unsafe-inline' https://*.addtoany.com https://*.pinterest.com; img-src 'self' data:;"

This explicitly allows domains such as https://*.addtoany.com (and https://*.pinterest.com if Pinterest is wanted, for example).