recommend setting base-uri to 'none' (ideally), 'self' or at least a specific domain (rarely needed) in Content Security Policy

This controls the base URI set by the `<base>` feature. As far as I know, that's rarely used or at least is contained within the same origin. Nearly every site should be able to set this to `none` to get rid of the attack surface.