<img src="data:image/png;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=" data-src="URL-TO-REAL-IMAGE.png">
This works fine, but shows an error at the browser console (Firefox, Chrome):
Refused to load the image 'data:image/png;base64,R0lGODlhAQABAAD/ACwAAAAAAQABAAACADs=' because it violates the following Content Security Policy directive: "default-src 'self' * 'unsafe-inline'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
Shouldn't 'unsafe-inline' allow exactly this? I'm confused.