接入AdSense并配置CSP后仍偶尔拦截pagead2框架，如何解决？

问题排查与缺失配置说明 #

• frameSrc规则缺少gmsg:协议源：错误日志明确显示该协议是AdSense内部跨帧通讯所需的合法源，未配置会导致部分场景下iframe加载被拦截
• 域名配置格式不规范：现有frameSrc中部分域名末尾带斜杠，CSP源匹配规则中域名后加斜杠会限制仅匹配根路径资源，AdSense会加载对应域名下多路径的iframe，触发匹配失败
• scriptSrc规则未覆盖AdSense脚本加载需求：AdSense核心脚本从pagead2.googlesyndication.com等域名加载，现有规则仅放行googleapis.com，无法满足加载需求
• 缺少其他资源类型的放行规则：AdSense运行时会加载广告图片、发起行为上报请求、动态插入广告样式，现有配置未覆盖imgSrc、connectSrc、styleSrc的相关规则

修正后的完整配置 #

app.use(
  helmet.contentSecurityPolicy({
    useDefaults: true,
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: [
        "'self'",
        "'unsafe-inline'",
        'googleapis.com',
        'https://pagead2.googlesyndication.com',
        'https://www.google.com'
      ],
      styleSrc: [
        "'self'",
        "'unsafe-inline'"
      ],
      imgSrc: [
        "'self'",
        'data:',
        'https://*.googlesyndication.com',
        'https://*.doubleclick.net',
        'https://*.googleusercontent.com'
      ],
      connectSrc: [
        "'self'",
        'https://pagead2.googlesyndication.com',
        'https://adservice.google.com'
      ],
      objectSrc: ["'none'"],
      frameSrc: [
        "'self'",
        'gmsg:',
        'https://pagead2.googlesyndication.com',
        'cm.g.doubleclick.net',
        'googleads.g.doubleclick.net',
        'www.google.com',
        'accounts.google.com',
        'https://adservice.google.com',
        'https://tpc.googlesyndication.com',
      ],
    },
  })
);

内容的提问来源于stack exchange，提问作者John Doe