Refused to load the image 'blob:...' because it violates the following Content Security Policy

Question

I got this error:

Refused to load the image 'blob:file:///cf368042-bf23-42b6-b07c-54189d3b0e01' because it violates the following Content Security Policy directive: "default-src * 'self' 'unsafe-inline' 'unsafe-eval' data: gap: content:". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

While trying to load a mapboxGL map. This is my CSP tag:

<meta http-equiv="Content-Security-Policy" 
    content="
      worker-src blob:; 
      child-src blob: gap:;
      default-src * 'self' 'unsafe-inline' 'unsafe-eval' data: gap: content:">

Answer 1

This is the fix for either image and base64.

Need to add img-src 'self' blob: data:; As follow:

<meta http-equiv="Content-Security-Policy" 
    content="
      worker-src blob:; 
      child-src blob: gap:;
      img-src 'self' blob: data:;
      default-src * 'self' 'unsafe-inline' 'unsafe-eval' data: gap: content:">

Answer 2

You need to add img-src blob: in your CSP value. Since img-src is absent, it is using default-src. You can set img-src * also. Please take a look at https://content-security-policy.com/ to check how to add CSP for image.