My website is defering some img loading by setting the img src value by JavaScript (from the img data-src value). In order to have still valid HTML as long as the URL is not set to img src, I am setting src to an inline embeded img like this:
<img src="data:image/png;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs="
data-src="URL-TO-REAL-IMAGE.png">
This works fine, but shows an error at the browser console (Firefox, Chrome):
Refused to load the image 'data:image/png;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=' because it violates the following Content Security Policy directive: "default-src 'self' * 'unsafe-inline'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
Shouldn't 'unsafe-inline' allow exactly this? I'm confused.