title: Preload and CSP in Chrome
body: <p>I have a site which has some <code>&lt;link rel="preload" href="...</code> tags on a web page, where I also want to add as strict as possible CSP headers and as part of that I want to use <code>default-src 'none'</code></p>
  
  <p>Currently Chrome supports prefetching, but it only support the CSP directive of <code>prefetch-src</code> behind a feature flag.
  So I can use the feature but not configure the security around it, so with the current <code>default-src 'none'</code> all prefetch calls are blocked.</p>
  
  <p>The only solution I can find is to  change <code>default-src 'none'</code> to <code>default-src 'self'</code>, but that will of course lessen security as a lot of unwanted resources could not potentially be loaded.</p>
  
  <p>Has anyone found a solution to this?</p>