title: Content Security Policy: allowing all external images?
body: <p>I'd like to allow scripts only from my local server with certain exceptions like jQuery etc., but be flexible to load external images.
  I'm aware that there is a directive like</p>
  
  <pre><code>Content-Security-Policy: script-src 'self' https://apis.google.com; img-src 'self' https://www.flickr.com;
  </code></pre>
  
  <p>to allow images from both, my own webserver and Flickr, but is it possible to allow images from <em>all</em> sources - or would this violate the whole concept of CSP and thus be impossible? I'm maintaining a blog often requiring to embed external images, so it basically comes up to a decision on whether it makes sense and is manageable to add CSP to my website or not.</p>