permits img-src from external website, other solution is to store base64 image of user in DB

note: if we need to keep this security, we need to store all user's images (blob_storage can be a good candidate)

src/interfaces/api/handlers/auth_handler.rs

@@ -326,7 +326,7 @@ async fn get_current_user(
 /// DTO for updating the user's profile image.
 #[derive(Debug, Deserialize, ToSchema)]
 pub struct UpdateUserImageDto {
-    /// New image URL (https/http) or data URI (data:image/…;base64,…). Null to clear.
+    /// Image URL (https/http) or data URI (data:image/png|webp|jpeg;base64,…). Null to clear.
     pub image: Option<String>,
 }
 

src/main.rs

@@ -525,7 +525,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                  script-src 'self'; \
                  worker-src 'self'; \
                  style-src 'self' 'unsafe-inline'; \
-                 img-src 'self' data: blob:; \
+                 img-src 'self' data: blob: https:; \
                  media-src 'self' blob:; \
                  connect-src 'self'; \
                  font-src 'self' data:; \