I get an error that I cannot load an inline bas64 image because of CSP. I have the CSP header set to the following:
img-src 'self' * data:;
When I check headers in developer tools, it is set. But default-src seems to be overriding img-src or chrome is ignoring img-src. I havent explicitly set default-src and I cant find it in headers (in chrome).
But I get the following error:
Refused to load the image 'data:image/webp;base64,UklGRh4AAABXRUJQVlA4TBEAAAAvAQAAAAfQ//73v/+BiOh/AAA=' because it violates the following Content Security Policy directive: "default-src *". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
I have found many similar questions on Stack Overflow about this but they mostly seem to be because the person doesnt know about CSP. And many of the answers seem to be turn down security overall.
Anyone have this problem? Where img-src seems to being ignored? Also if I set img-src to 'self' the error changes and blames it on the img-src rule so clearly it recognizes img-src some of the time.
I dont think its relevant but backend is written in Java Play Framework 2.6.
Aucun commentaire:
Enregistrer un commentaire