: Defer img loading / CSP: allow embeded img My website is defering some img loading by setting the img src value by JavaScript (from the img data-src value). In order to have still valid HTML

@Courtney195

Posted in: #ContentSecurityPolicy #Html #Http

My website is defering some img loading by setting the img src value by JavaScript (from the img data-src value). In order to have still valid HTML as long as the URL is not set to img src, I am setting src to an inline embeded img like this:

<img src="data:image/png;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs="
data-src="URL-TO-REAL-IMAGE.png">


This works fine, but shows an error at the browser console (Firefox, Chrome):


Refused to load the image
'data:image/png;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=' because
it violates the following Content Security Policy directive:
"default-src 'self' * 'unsafe-inline'". Note that 'img-src' was not
explicitly set, so 'default-src' is used as a fallback.


Shouldn't 'unsafe-inline' allow exactly this? I'm confused.

Vote Up Vote Down

Login to post a comment!