Content security policy and dog image in login page?

[axzxc1236]

I tried to enable security related flag for httpd section, I put in default-src 'self' in CSP header and restarted sftpgo, the login image is gone.

So I tried to debug with developer console and saw it attempts to use external image, so I make it default-src 'self': img-src * and then saw a dog image show up instead of SFTPGo logo.

Is this an Easter egg that I don't get the humor of? nosniff flag doesn't make any difference, branding section also doesn't change the image.

[axzxc1236]

Answering my own question, SFTPGo uses inline CSS for some customization so 'unsafe-inline' is required.

There are entries in CSS file that is usually overwritten by inline CSS (dog picture) but in my case inline CSS was blocked so fallback picture (the dog) is shown.

[drakkan]

I tried to enable security related flag for httpd section, I put in default-src 'self' in CSP header and restarted sftpgo, the login image is gone.

So I tried to debug with developer console and saw it attempts to use external image, so I make it default-src 'self': img-src * and then saw a dog image show up instead of SFTPGo logo.

Is this an Easter egg that I don't get the humor of? nosniff flag doesn't make any difference, branding section also doesn't change the image.

1cbaa7c