How to configure CSP for all all Google domains (i.e. .com, .de, .fr, etc)

Question

I am whitelisting domains for CSP headers. Is there any recommendation for whitelisting a big list of domain, all belonging to the same company e.g. google.de, google.fr, etc.

If I understand correctly, *.mydomain.com means both subdomains of mydomain.com and also mydomain.com itself. For security itself, it doesn't make sense to allow any top level domain of google.<tld>, yet it would be very convenient to have a shorthand way to list all google.<tld> that I can find.

Is there a shorter / better alternative to maintaining a list of all possible google.*?

Answer 1

At least for now, a seemingly reliable list would be: https://www.google.com/supported_domains