diff --git a/html/sandboxes/odfcanvas_sandbox.html b/html/sandboxes/odfcanvas_sandbox.html
index 40ee1e35..2fa64ba5 100644
--- a/html/sandboxes/odfcanvas_sandbox.html
+++ b/html/sandboxes/odfcanvas_sandbox.html
@@ -2,7 +2,6 @@
 <html>
 	<head>
 		<title>WebODF Sandbox</title>
-		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src <%.Origin%>; img-src data:; style-src 'unsafe-inline'">
 		<base href="<%.Cfg.B%>">
 		<style type="text/css">
 		html, body {
diff --git a/html/sandboxes/pdfcanvas_sandbox.html b/html/sandboxes/pdfcanvas_sandbox.html
index 4380c57c..73840787 100644
--- a/html/sandboxes/pdfcanvas_sandbox.html
+++ b/html/sandboxes/pdfcanvas_sandbox.html
@@ -2,7 +2,6 @@
 <html>
 	<head>
 		<title>pdf.js Sandbox</title>
-		<meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src <%.Origin%> 'unsafe-eval'; img-src 'self'; style-src 'unsafe-inline'">
 		<base href="<%.Cfg.B%>">
 		<style type="text/css">
 		html, body {
diff --git a/src/app/spreed-webrtc-server/main.go b/src/app/spreed-webrtc-server/main.go
index 07ce3220..ca785a64 100644
--- a/src/app/spreed-webrtc-server/main.go
+++ b/src/app/spreed-webrtc-server/main.go
@@ -181,19 +181,30 @@ func handleSandboxView(sandbox string, origin string, w http.ResponseWriter, r *
 	w.Header().Set("Expires", "-1")
 	w.Header().Set("Cache-Control", "private, max-age=0")
 
-	//w.Header().Set("Content-Security-Policy", config.contentSecurityPolicy)
-
-	var err error
 	sandboxTemplateName := fmt.Sprintf("%s_sandbox.html", sandbox)
 
 	// Prepare context to deliver to HTML..
 	if t := templates.Lookup(sandboxTemplateName); t != nil {
+
+		// CSP support for sandboxes.
+		var csp string
+		switch sandbox {
+		case "odfcanvas":
+			csp = fmt.Sprintf("default-src 'none'; script-src %s; img-src data: blob:; style-src 'unsafe-inline'", origin)
+		case "pdfcanvas":
+			csp = fmt.Sprintf("default-src 'none'; script-src %s 'unsafe-eval'; img-src 'self' data: blob:; style-src 'unsafe-inline'", origin)
+		default:
+			csp = "default-src 'none'"
+		}
+		w.Header().Set("Content-Security-Policy", csp)
+
 		// Prepare context to deliver to HTML..
-		context := &Context{Cfg: config, Origin: origin}
-		err = t.Execute(w, &context)
+		context := &Context{Cfg: config, Origin: origin, Csp: true}
+		err := t.Execute(w, &context)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
 		}
+
 	} else {
 		http.Error(w, "404 Unknown Sandbox", http.StatusNotFound)
 	}
