Directive: img src

Overview

The img-src directive specifies valid sources of images and favicons.

Affects: <img>; <link rel=icon>; <picture> → <source>

Required reading:

• Can I use img-src?
• MDN Web Docs reference

Usage examples

Accepts one or more schemes or hosts, the 'self' keyword, or the 'none' keyword.

img-src 'none'

img-src 'self'

img-src example.com

img-src example.com example.org

img-src https://fonts.google.com

img-src https:

Fallbacks

✅ img-src will fallback to child-src, which will fallback to default-src if it is undefined.

• default-src
  • img-src

Possible errors

[ERROR] directive img-src has an invalid value

Possible allowed values for img-src are:

1. 'none'
2. A scheme like https:
3. A host like example.com
4. A keyword like 'self'
5. A nonce (although this is highly unusual)
6. A sha256 hash (although this is highly unusual)

This error message means that the value does not match expected/correct patterns for any of these types.

For developers

ABNF (CSP3)

directive-name  = "img-src"
directive-value = serialized-source-list

See ABNF: serialized-source-list

Type

• source-list in CSP2
• serialized-source-list in CSP3

References

• CSP Level 2 reference
• CSP Level 3 reference
• MDN Web Docs reference
• Can I use img-src?