Allow `data:` urls for `img-src` in CSP policies

This allows browser to display embedded images with `data:` urls.
1 changed files with 1 additions and 1 deletions
--- a/web/middleware.ts
+++ b/web/middleware.ts
@ -37,7 +37,7 @@ export function middleware(request: NextRequest) {
    style-src 'self' 'unsafe-inline' ${scheme_source} ${whiteList};
    worker-src 'self' ${scheme_source} ${csp} ${whiteList};
    media-src 'self' ${scheme_source} ${csp} ${whiteList};
-    img-src *;
+    img-src http: https: data:;
    font-src 'self';
    object-src 'none';
    base-uri 'self';