CSP allow specific: data:font/woff;base64,"someBase64encoded font", WITHOUT using csp: font-src 'self' data:

Question

Have a few embed base64 fonts in some css files, but CSP blocks these: something like url("data:font/woff;base64,d09GRk9UVE...);

Current CSP = "base-uri 'self'; connect-src 'self'; default-src 'none'; font-src 'self'; form-action 'self'; frame-ancestors 'none'; frame-src 'self'; img-src 'self'; script-src 'self'; style-src 'self';"

W3 and MDN say I could add a hash, but this doesn't seem to work either

tried sha256,sha384,sha512

Answer 1

Add data:to font-source, e.g.

font-src 'self' data:;