Content Security Policy: The page’s settings blocked the loading of a resource at data:image/svg+xml;base64,PHN2ZyB3aWR0aD… (“default-src”)

Question

I am trying to add a paypal button, but the image doesnt load and gives the below error

Content Security Policy: The page’s settings blocked the loading of a resource at data:image/svg+xml;base64,PHN2ZyB3aWR0aD… (“default-src”)

Below is my meta code

<meta http-equiv="Content-Security-Policy" content="default-src * 'data'; img-src: *; style-src 'self' 'unsafe-inline' https://* http://*; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://* http://*" />

I have many external scripts/css/images which are loaded and i want allow everything to load without getting blocked.

Any help will be appreciated

Answer 1

You have defined img-src with just * which will include everything HTTP or HTTPS depending on your connection. 'data' will not be included. You will need to include data: (with the colon but without quotes) to img-src. You have included 'data' in default-src, but as you have defined img-src this fallback will not be used. Also check your syntax as pointed out by @sideshowbarker.