Our content security policy includes maps.googleapis.com which is flagged on some auditing tools online as a major problem because some of its endpoints support JSONP supposedly.
So because of that I’m trying to either remove the url while of course still using google maps or changing the content security policy in a way that its not a problem anymore.

I’ve seen that hashes and nonces are a good fit for this, but here is the problem. The front end is being hosted on cloudfront and without using lambdas or cloudfront functions updating the content security policy for nonces or hashes isn’t really doable. At least to my knowledge.

Adding an integrity hash to the scrip tag also does not work because it seems that the content security policy takes priority over that.

Is there any alternative to all of this, to load google maps while having a more secure content security policy?
Or alternatively solid proof that google maps does not have endpoints that support JSONP?

Thank you for the pointers or help in advance,