I'm setting Content-Security-Policy in htaccess.

I use a pretty basic and strict policy:

Header always set Content-Security-Policy
"default-src 'self';
script-src 'self' http: https: *.googleapis.com *.google-analytics.com;
style-src 'self';
img-src 'self' http: https: *.google-analytics.com;
frame-src 'none'"
It works fine for the website.

But if I rightclick an image on my website and "open image in new tab" in Chrome, I get this error in console:

"Refused to apply inline style because it violates the following Content Security Policy directive: "style-src 'self'". Either the 'unsafe-inline' keyword, a hash or a nonce is required to enable inline execution."

This seems to be caused by the browser (chrome) itself adding inline style to images.

The image is shown, but the black background is now white (default). Maybe other styling too, I don't know

How do I get around this? Or doesn't it matter at all?

I don't want to set a loose policy just because of chrome's behavior, as that would defeat its purpose.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.