diff --git a/packages/config/test/options.test.js b/packages/config/test/options.test.js
index 4fb683e8c7..d4b4ff1f0d 100644
--- a/packages/config/test/options.test.js
+++ b/packages/config/test/options.test.js
@@ -98,12 +98,12 @@ describe('config: options', () => {
   })
 
   test('should enable csp', () => {
-    const { render: { csp } } = getNuxtConfig({ render: { csp: { allowedSources: [], test: true } } })
+    const { render: { csp } } = getNuxtConfig({ render: { csp: { allowedSources: ['/nuxt/*'], test: true } } })
     expect(csp).toEqual({
       hashAlgorithm: 'sha256',
       addMeta: false,
       unsafeInlineCompatibility: false,
-      allowedSources: [],
+      allowedSources: ['/nuxt/*'],
       policies: undefined,
       reportOnly: false,
       test: true
@@ -112,12 +112,12 @@ describe('config: options', () => {
 
   // TODO: Remove this test in Nuxt 3, we will stop supporting this typo (more on: https://github.com/nuxt/nuxt.js/pull/6583)
   test('should enable csp with old typo property name, avoiding breaking changes', () => {
-    const { render: { csp } } = getNuxtConfig({ render: { csp: { allowedSources: [], test: true, unsafeInlineCompatiblity: true } } })
+    const { render: { csp } } = getNuxtConfig({ render: { csp: { allowedSources: ['/nuxt/*'], test: true, unsafeInlineCompatiblity: true } } })
     expect(csp).toEqual({
       hashAlgorithm: 'sha256',
       addMeta: false,
       unsafeInlineCompatibility: true,
-      allowedSources: [],
+      allowedSources: ['/nuxt/*'],
       policies: undefined,
       reportOnly: false,
       test: true
diff --git a/packages/server/src/middleware/nuxt.js b/packages/server/src/middleware/nuxt.js
index 2fced72096..123b99b05e 100644
--- a/packages/server/src/middleware/nuxt.js
+++ b/packages/server/src/middleware/nuxt.js
@@ -127,7 +127,7 @@ const getCspString = ({ cspScriptSrcHashes, allowedSources, policies, isDev }) =
   const joinedHashes = cspScriptSrcHashes.join(' ')
   const baseCspStr = `script-src 'self'${isDev ? ' \'unsafe-eval\'' : ''} ${joinedHashes}`
 
-  if (Array.isArray(allowedSources)) {
+  if (Array.isArray(allowedSources) && allowedSources.length) {
     return `${baseCspStr} ${allowedSources.join(' ')}`
   }