防止图像加载的内容安全策略

Question

I have an express app which is loading some external assets, but they're getting blocked by CSP. I've never had this issue before, but this is the first time im using passport.js and helmet.js within an app so maybe this has something to do with their configuration?

Refused to load the image 'https://fake-url.com' because it violates the following Content Security Policy directive: "img-src 'self' data:".

I've tried adding a meta tag to allow images from external sources but this seems to have no effect. Any help would be appreciated.

Answer 1

You have

content="default-src 'none'

This prevents loading resources from any source. Remove it.

Then change it to:

default-src 'self' fake-url.com';

More info bout the HTTP Content-Security-Policy response header below:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy

https://content-security-policy.com/