permits img-src from external website, other solution is to store base64 image of user in DB

note: if we need to keep this security, we need to store all user's images (blob_storage can be a good candidate)
2026-05-26 01:50:59 +02:00
parent b0c5e7827e
commit 4a5e9a67ca
2 changed files with 2 additions and 2 deletions
@@ -525,7 +525,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
                 script-src 'self'; \
                 worker-src 'self'; \
                 style-src 'self' 'unsafe-inline'; \
-                 img-src 'self' data: blob:; \
+                 img-src 'self' data: blob: https:; \
                 media-src 'self' blob:; \
                 connect-src 'self'; \
                 font-src 'self' data:; \