Rules apply to resource types
Servers commonly send policy in a Content-Security-Policy response header, using directives for scripts, images, connections and other uses. default-src provides fallback for fetch directives rather than a universal switch or an extra list merged into every explicit rule.
An explicit script-src governs its script checks without inheriting an additional allow set from default-src. Allowing a source for images does not automatically permit scripts from it.
References: [1]
A nonce identifies explicitly permitted content
A nonce source associates policy permission with matching elements, allowing content otherwise subject to inline restrictions. It is a binding, not script encryption; indiscriminately assigning it to unknown scripts defeats that distinction.
CSP3 requires a unique, unpredictable nonce when transmitting such a policy. One permanent shared constant is not equivalent, and an attacker able to obtain and reuse a permitted nonce may bring content within its allowance.
References: [1]
Reporting differs from blocking
Report-Only monitors violations without blocking them. Multiple enforced policies apply together, so adding a looser policy does not erase a stricter one. Meta delivery also lacks some response-header capabilities.
CSP can expose deployment issues and constrain execution without correcting unsafe data flow. Context handling, sanitization and template protections remain necessary, and script permission does not authorize every server operation it requests.