0

I follow the instructions to set CSP to allow everything in .htaccess as below:

Header Set Content-Security-Policy "default-src * 'unsafe-inline' 'unsafe-eval'"

However, after that, when visiting my website, I still get 28 errors, as below:

28Refused to load the image '<URL>' because it violates the following Content Security Policy directive: "default-src * 'unsafe-inline' 'unsafe-eval'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

And below is a screenshot: enter image description here

Why?

alancc
  • 635
  • 2
  • 19
  • 53
  • That's because `data:`-Urls are not covered by `*`. Use `default-src * data: 'unsafe-inline' 'unsafe-eval'`, which is almost equivalent to no CSP. – granty Aug 17 '21 at 13:48

0 Answers0