0

Is there any reason to show a Content-Security-Policy (CSP) HTTP Header for direct links to images such as https://invalid.tld/direct-link-to-image.jpeg?

Improve this question
1
  • The CSP header generally only makes sense for HTML documents, as it specifies what the document will include.
    – user163495
    Jun 11, 2020 at 13:18

1 Answer 1

Reset to default
2

If you are sending the correct type in the Content-Type header, the X-Content-Type-Options is set to nosniff and the image is not in SVG format, CSP shouldn't be necessary. CSP is also not necessary if the content is trusted (i.e. not user-generated) and static.

User-generated SVG is dangerous because the user can upload something like

<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS!')"></svg>

and send a direct link to another user.

However note that although in some cases there is no reason to enable CSP, there is also no reason not to enable CSP (other than saving a few bytes). If you accidentally disable CSP for dynamic HTML pages, you can open your website to more XSS attacks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .