Is there any reason to show a Content-Security-Policy (CSP) HTTP Header for direct links to images such as https://invalid.tld/direct-link-to-image.jpeg
?
-
The CSP header generally only makes sense for HTML documents, as it specifies what the document will include.– user163495Jun 11, 2020 at 13:18
1 Answer
If you are sending the correct type in the Content-Type
header, the X-Content-Type-Options
is set to nosniff
and the image is not in SVG format, CSP shouldn't be necessary. CSP is also not necessary if the content is trusted (i.e. not user-generated) and static.
User-generated SVG is dangerous because the user can upload something like
<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS!')"></svg>
and send a direct link to another user.
However note that although in some cases there is no reason to enable CSP, there is also no reason not to enable CSP (other than saving a few bytes). If you accidentally disable CSP for dynamic HTML pages, you can open your website to more XSS attacks.