Content-Security-Policy 'image-src *'

Question

I set the Content-Security-Policy for the application with a wild-card for image-src

But, while uploading an image from browser, I see this error below:

Refused to load the image ' blob:http%3A//localhost.abc.com%3A8000/6f5b1ad8-69fc-4e84-a58c-1a95cbba4900 ' because it violates the following Content Security Policy directive: "img-src *" .

However, other images from the same domain are loading fine. Only problem is when you try to upload one!

Answer 1

I solved this with updating my img-src CSP, I am using s3 for image upload.

  imgSrc: ["'self'", 'data:', 'blob:', 'https://yourdomain.com', 'https://s3-us-west-2.amazonaws.com']

I am using Helmetjs with Node