I'm currently experiencing an issue where base64 encoded fonts are being blocked by CSP on my website (note that I replaced the base64 with
abcdefg in this example:
Refused to load the font 'data:font/woff2;base64,abcdefg///abcdefg' because it violates the following Content Security Policy directive: "font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com".
The fix for this is to add
data: to the fonts-src directive in the content security policy, for example:
"font-src 'self' data: https://fonts.googleapis.com https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com"
However, this opens my website up to data from all sources, not just the sites I have specified. I know that use of
data: for default-src is deemed insecure in relation to XSS attacks, see this previous question
However what is not clear to me is if it is insecure for specifically font-src. What is the worst that could happen if I used this? Will a script kiddie convert my site into wingdings? I have found no evidence anywhere that it would have harmful effects, but at the same time it seems it is recommended everywhere with reckless abandon.
Can someone give me the definitive answer on this? And if it is indeed insecure, why is
data: even a feature of CSP if it opens everyone up to accidental security incidents?