How to only allow img-src: data:image/png (base64) in the Content Security Policy

user_2432090 0
Viewed 1175

I'm trying to load an image in ASP.Net Core that's blocked by my CSP.

<img src="@(string.Format("data:image/png;base64,{0}", example))" />

Now I've read you can use the following to allow all data schemes

img-src: data:

Or if you only want to allow SVG's:

img-src: data:image/svg+xml

Does anyone know how to only allow PNG? img-src: data:image/png doesn't seem to work and I can't find any spec on it.

content-security-policy
1 Answers

Unfortunately it's not possible to do what you want.

Current CSP realisation does not support the data: scheme with host-part. The data:image/svg+xml syntax is ignored by browsers. The same is for data:image/png, data:image/gif, data:text/javascript etc.

Valid is only: img-src data:

user_128659440
Related