Bezpečnostní hlavičky - api.mapy.cz

$nonce = base64_encode(random_bytes(16));
        header("Content-Security-Policy: "
                . "default-src 'none';"
                . "script-src 'self' 'nonce-$nonce' 'strict-dynamic' * 'unsafe-inline' https://maps.gstatic.com https://maps.googleapis.com https://api.mapy.cz;"
                . "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://widget-v2.smartsuppcdn.com  https://api.mapy.cz;"
                . "img-src 'self' data: https://mapserver.mapy.cz https://api.mapy.cz https://www.google-analytics.com https://im9.cz https://maps.gstatic.com https://www.gstatic.com https://maps.googleapis.com https://www.smartsuppchat.com https://widget-v2.smartsuppcdn.com https://twemoji.maxcdn.com https://files.smartsuppcdn.com maps.gstatic.com *.googleapis.com *.ggpht;"
                . "form-action 'self';"
                . "base-uri 'none';"
                . "manifest-src 'none';"
                . "object-src 'none';"
                . "style-src-elem 'self' 'unsafe-inline' https://api.mapy.cz https://widget-v2.smartsuppcdn.com;"
                . "script-src-elem 'nonce-$nonce' https://api.mapy.cz https://ssl.heureka.cz https://www.smartsuppchat.com https://widget-v2.smartsuppcdn.com https://api.mapy.cz;"
                . "frame-src 'self' https://www.heureka.cz;"
                . "font-src https://fonts.googleapis.com https://fonts.gstatic.com https://api.mapy.cz;"
                . "media-src 'self' https://widget-v2.smartsuppcdn.com;"
                . "connect-src 'self' https://bootstrap.smartsuppchat.com https://widget-v2.smartsuppcdn.com wss://websocket-visitors.smartsupp.com https://widget-v1.smartsuppcdn.com https://www.google-analytics.com https://files.smartsupp.com https://maps.gstatic.com https://maps.googleapis.com;"
                . "frame-ancestors 'self' https://www.domena.cz;"
                . "");

<script nonce="<?=$nonce?>">
            function mapa() {
            window.open("http://www.mapy.cz/#st=s@sss=1@ssq=id%3Apremise%202106041@@","Mapa",'toolbar=0,location=0,scrollbars=1,width=900,height=700,resizable=0,top=20,left=20');
            }
        </SCRIPT>
        <script nonce="<?=$nonce?>" src="https://api.mapy.cz/loader.js" crossorigin="anonymous"></script>
    <script nonce="<?=$nonce?>">Loader.load()</script>

Content Security Policy: Nastavení stránky zablokovalo načítání zdroje na [url=https://api.mapy.cz/config.js?key=&v=0.6479842353191367]api.mapy.cz/config.js?key=&v=0.6479842353191367[/url] („script-src“).