login.gov, the single sign-on service for US federal services, runs a strict nonce-based Content Security Policy with no unsafe-inline and no unsafe-eval anywhere in it. In this whole body of research it is the only production policy of which that is true.
And because the service is developed in the open, the policy is not something you have to infer from a header. It is a file in the repository, with twelve commits of history behind it that you can read.
What their headers say
secure.login.gov — HTTP response header
content-security-policy: default-src 'self'; child-src 'self';
form-action 'self'; block-all-mixed-content;
object-src 'none'; base-uri 'self';
style-src 'self' … 'nonce-640d05ab659d…';
script-src 'self' … 'nonce-640d05ab659d…'
Nonces on both scripts and styles, which most deployments never manage, and form-action 'self' — the directive that stops an injected login form posting someone's credentials to another origin.
Not a customer
login.gov has no relationship with Report URI and nothing here is an endorsement by the US government. Their policy carries no reporting at all, which is a defensible choice for one tightly controlled login page and a much harder one for a site with marketing tags and four teams shipping to it.
