Loading image SVG and getting Content Security Policy (CSP) error

Question

I'm trying to load SVG images and get a CSP error as follows:

I keep getting the error event when I added the meta tag:

<meta http-equiv="Content-Security-Policy" content="default-src *;img-src * 'self' data: https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; style-src  'self' 'unsafe-inline' *" >

Answer 1

The error that you can see tells you that the img-src was not set and it fallbacks to default-src even though that you have added meta tag with your CSP values.

This behaviour can be observed when the CSP header is already set via HTTP . You have to choose whether to set it via HTTP or as meta tag.