Content Security Policy - data:image/svg+xml is ignored in img-src

Question

My CSP header looks like this (actually, it's only the part relevent to loading images), which should be valid. But Chrome complains that "The source list for Content Security Policy directive 'img-src' contains an invalid source: 'data:image/svg+xml'. It will be ignored."

img-src data:image/svg+xml 'self' https://stats.g.doubleclick.net/r/collect https://www.facebook.com/tr/ https://www.google-analytics.com/r/collect data:image/svg+xml;

It should be valid, I've found it in examples around the web, yet it does not work. For example it is suggested here https://security.stackexchange.com/questions/94993/is-including-the-data-scheme-in-your-content-security-policy-safe/95011#95011

Please provide valid and working example, I am lost in this maze.

Answer 1

Your example CSP is invalid. According to MDN Documentation you should use only hosts, schemas or other constant values. After correction, you example should look like:

img-src 'self' https://stats.g.doubleclick.net/ https://www.facebook.com/ https://www.google-analytics.com/ data:;