title: How to write a CSP with wildcard?
body: <p>I am writing a CSP for my website, the header is added via Lambda@Edge on AWS for my site on lightsail. I've got the CSP set as follows, been trying to get it to work: <code>content-security-policy: default-src 'self' *.thetechcapsule.com thetechcapsule.com; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'</code></p>
  <p>My domain is thetechcapsule.com and I have cloudfront CDN set up via <a href="http://www.thetechcapsule.com" rel="nofollow noreferrer">www.thetechcapsule.com</a>. I thought the wildcard would allow all subdomains but it's not working, getting script errors, but they should be using the default source?</p>
  <p>E.g of error in console</p>
  <pre><code>Refused to load the script '&lt;URL&gt;' because it violates the following Content Security Policy directive: &quot;script-src 'self'&quot;. Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
  </code></pre>
  <p>Thanks</p>