After adding a content security policy to my MCV.NET web service: default-src 'self' my Chrome browser no longer formats XML responses.
When I look in the Chrome DevTool's Network tab, it shows calls from the source of "data:" for an inline image, font and style.
How can I safely allow Chrome to format my XML responses?
Would this be safe? default-src 'self' data: 'unsafe-inline'