CSP error when using next/image
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 142k
- Forks
- 32.4k
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 351
Description
Verify canary release
- I verified that the issue exists in the latest Next.js canary release
Provide environment information
Operating System:
Platform: darwin
Arch: arm64
Version: Darwin Kernel Version 21.6.0: Sun Nov 6 23:29:57 PST 2022; root:xnu-8020.240.14~1/RELEASE_ARM64_T8101
Binaries:
Node: 18.12.1
npm: 9.3.1
Yarn: 3.3.1
pnpm: N/A
Relevant packages:
next: 13.1.5-canary.2
eslint-config-next: 13.1.4
react: 18.2.0
react-dom: 18.2.0
Which area(s) of Next.js are affected? (leave empty if unsure)
Image optimization (next/image, next/legacy/image)
Link to the code that reproduces this issue
https://github.com/ennair/next-test/tree/next-image-test
To Reproduce
- Checkout the project.
- Run yarn
- Run yarn build
- Run yarn start
- Open localhost:3000
- You will see the page loading with an image and in the console a CSP error.
Describe the Bug
When using next/image it always adds inline styling on the image. It adds: style="color:transparent".
Also in case I add my own styling. Because of this, I get a CSP error. I have to add style-src 'unsafe-inline', which I do not want to add.
Expected Behavior
Next/image should not add inline styling on the image component.
Which browser are you using? (if relevant)
No response
How are you deploying your application? (if relevant)
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked next-image-test reproduction: run yarn, yarn build, yarn start, and inspect the page and browser console. Investigate the next/image behavior that produces style="color:transparent" under the reported CSP. Done means the reproduction no longer triggers a CSP error without requiring style-src 'unsafe-inline'.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nextjs, react
- Domain
- frontend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100