title: How to define a Content Security Policy (CSP) that utilizes 'strict-dynamic' but includes fallback to use 'unsafe-inline'?
body: <p>I'm implementing the CSP header on a website that needs to dynamically load some scripts due to various reasons (mostly plugins).
  This is easily achieved by defining script-src using 'strict-dynamic' along with a hash/nonce for the non-dynamic scripts.</p>
  
  <p>The recommendations everywhere suggest also including some high level sources/schemes and 'unsafe-inline' as fallback, in case the browser doesn't support CSPv3 and thus, doesn't support 'strict-dynamic' and dynamic loading:</p>
  
  <pre><code>script-src: 'strict-dynamic' 'sha256-somesortofhash...' https: 'unsafe-inline';
  </code></pre>
  
  <p>This fallback method will work fine for browsers that only support CSPv1:</p>
  
  <ul>
  <li>'strict-dynamic' is ignored (unrecognized).</li>
  <li>hash value is ignored (unrecognized).</li>
  <li>https: and 'unsafe-inline' are enforced.</li>
  </ul>
  
  <p>But doesn't seem to work for CSPv2 browsers: </p>
  
  <ul>
  <li>'strict-dynamic' is ignored (unrecognized).</li>
  <li>hash value is enforced.</li>
  <li>https: is enforced.</li>
  <li>'unsafe-inline' is ignored (due to enforcement of hash).</li>
  </ul>
  
  <p>How can I define a policy with proper fallback for CSPv2 browsers as well?</p>