1

I have htaccess with some directives

Header set Content-Security-Policy " default-src 'self' site.com *.site.com; connect-src 'self' site.com *.site.com; font-src 'self' site.com *.site.com; frame-src 'self' site.com *.site.com; img-src 'self' site.com *.site.com; object-src 'self' site.com *.site.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' site.com *.site.com; style-src 'self' 'unsafe-inline' site.com *.site.com; "

When i try load image i get this error(chrome browser console log):

 Refused to load the image 'blob:http%3A//site.com/a2rt87-cyud4-4f42-...' because it violates the following Content

And if i remove Content-Security-Policy strings in my htaccess file everything works fine.

All js scripts hosted in subfolder.

Which side leads this error? Problem in htaccess or javascript file? And how i can solve this problem?

Arman
  • 113
  • 1
  • 9

1 Answers1

1

I think the problem is Content Security Policy rule. Exactly, this one:

img-src 'self' site.com *.site.com; "

And you try to edit "blobs". The detailed info what is happening could be found here.

Community
  • 1
  • 1
kaapa
  • 507
  • 4
  • 12