Have django-csp working in report only mode on application deployed on aws using gunicorn/nginx. No reported issues in dev or prod except when clients log into their work computers to work remotely. Using a secured remote desktop session (I can recreate accessing production web using browser running in vm). I get nothing but errors and warnings about hosted page injection.

Now my understanding is that CSP is meant to protect against unauthorized CSS but are there settings or headers that will allow site to operate in an approved remote window.

Any guidance is appreciated.