Content Delivery Policy setup

Question

I want to secure my website using a Content Security Policy. I'm came up with the following policy:

X-Content-Security-Policy: default-src https://www.example.com https://static.example.com; script-src https://ajax.googleapis.com

I have two questions regrding the Content Security Policy I want to set.

1. I use Google's CDN only to get the jQuery library. Is it possible to make a policy that only allows certain scripts to load from a domain instead of the generic script-src?
2. Is my policy correct? E.g. having two domains for the default-src and a separate one for script-src. Will I still be able to server script-src files through my own domains?

Answer 1

For Q1: No. In the W3C spec it says that script-src specifies hosts as follows:

( [ scheme "://" ] host [ port ] )

so nothing after the host or port can be used.

For Q2: From my reading of the spec, yes, it's correct.

If not specified explicitly in the policy, the directives listed above will use the default sources.

So you have two domains as defaults for everything, and then you further refine script-src with a particular domain. However if you want to serve script-src files from your own domain then you'll need to add your domain after ajax.googleapis.com.