Content security policy
Open
bug
- Dominant language
- JavaScript
- Stars
- 5.8k
- Forks
- 585
- PR merge metrics
- No merged PRs in 30d
Description
What's the best way to enable a Content Security Policy on my pages so that SVGs generated by holder.js are not blocked ? I have an img-src of self and that does not permit holder.js generated images to be served by the browser.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing how holder.js generates SVG images and how the reported img-src 'self' policy blocks them in browsers. Document the CSP configuration needed for pages using holder.js, with a clear example and verification that the generated images load without being blocked.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- frontend, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100