"Content Security Policy (CSP) header cannot be parsed successfully"

[cuibonobo]

Mozilla HTTP Observatory can't parse my CSP headers for some reason. Testing my site with curl -v shows:

content-security-policy: default-src 'self'; script-src 'self' static.cloudflareinsights.com; object-src 'none' ; frame-ancestors 'none'

Not sure what part of this is not parseable.

[cuibonobo]

Turns out SveltKit is adding <meta http-equiv="content-security-policy" content=""> to my HTML, which causes the HTTP Observatory parsing to fail. Will fix on my end but also created mozilla/http-observatory#492.

[cuibonobo]