[a.] If cross-origin anything is forbidden by default, opt in to cross-domain images with CSP 'img-src'

[b.] No You Can't Use a CDN™, or rather, you can [1][2], but some portion of the domain name of the URL has to be the same, or you can only whitelist your own subdomains, or something of the like. This will have to trigger a larger conversation about the nature of subdomains, DNS, possibly TLS DV certs, and how you can prove that your own subdomains are not outside of your control -- both for the satisfaction of DV certs, but also to the satisfaction of CSP.

[1] https://azure.microsoft.com/en-us/documentation/articles/cdn... [2] https://www.maxcdn.com/one/tutorial/creating-cname-dns-recor...

Part of the problem is, right now, the 'default' CSP is neither opt-in, nor opt-out (EDIT: this is technically incorrect, but what I meant to say is, the effect of CSP defaults and their interplay with stuff like same-orgin policy isn't lockdown-by-default) It's whatever legacy behavior the browsers of the world have collectively implemented, but nonetheless pending each of their whims and changelogs. This makes it so that your CSP rules merely override the default, and you're not universally protected from just about anything when you don't specify a policy.