Is there any reason to show a Content-Security-Policy (CSP) HTTP Header for direct links to images such as https://invalid.tld/direct-link-to-image.jpeg?

  • The CSP header generally only makes sense for HTML documents, as it specifies what the document will include.
    – MechMK1
    Jun 11 '20 at 13:18

If you are sending the correct type in the Content-Type header, the X-Content-Type-Options is set to nosniff and the image is not in SVG format, CSP shouldn't be necessary. CSP is also not necessary if the content is trusted (i.e. not user-generated) and static.

User-generated SVG is dangerous because the user can upload something like

<svg xmlns="http://www.w3.org/2000/svg" onload="alert('XSS!')"></svg>

and send a direct link to another user.

However note that although in some cases there is no reason to enable CSP, there is also no reason not to enable CSP (other than saving a few bytes). If you accidentally disable CSP for dynamic HTML pages, you can open your website to more XSS attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.