CSP img-src
Where images may be loaded from.
- Falls back to
default-src- Group
- Fetch directives
Detail
Usually the most permissive directive, since images are low risk. data: is commonly needed for inline SVG and base64 thumbnails. The residual concern is tracking: an injected image URL can beacon out to an attacker, which is why 'self' data: is better than *.
Example
img-src 'self' data: https: