CSP允许特定：data：font / woff; base64，“someBase64encoded font”，不使用csp：font-src'self'数据：

Question

Have a few embed base64 fonts in some css files, but CSP blocks these: something like url("data:font/woff;base64,d09GRk9UVE...);

Current CSP = "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'self'; img-src 'self'; script-src 'self'; style-src 'self';"

W3 and MDN say I could add a hash, but this doesn't seem to work either

tried sha256 , sha384 , sha512

Answer 1

添加data:到font-source，例如

font-src 'self' data:;