reCAPTCHA with Content Security Policy

Question

I\'m trying to make reCAPTCHA work along with a strict Content Security Policy. This is the basic version I have, which works correctly:

HTML

Answer 1

The reCAPTCHA service has been updated so style-src 'unsafe-inline' is not required anymore. Below HTML and HTTP headers should work per this closed issue:

HTML:

HTTP Header:

Content-Security-Policy: default-src 'self'; script-src 'nonce-{NONCE}'; img-src www.gstatic.com; frame-src www.google.com; object-src 'none'; base-uri 'none';