# Content-security-policy refused to load image

**URL:** <https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957>\
**Category:** ionic-v1\
**Created:** [August 18, 2016, 8:37pm UTC](https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957 "2016-08-18T20:37:38Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hawkeye](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Hawkeye](https://forum.ionicframework.com/u/Hawkeye)\
**Post date:** [August 18, 2016, 8:37pm UTC](https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957/1 "2016-08-18T20:37:38Z")

</div>

Hi,

I realise this is not completely Ionic related but I’m wondering if anyone can help me out here as I’m going slightly crazy.

I am using ng-file-upload to allow the user to select an image or video from their phone. However I keep getting the following error. No combination of content-security-policy entries seems to work apart from if I add ‘\*’ to image-src and connect-src

Error:  
Refused to load the image ‘blob:null/eca5cf55-4440-4ddc-8fcb-94cca13ac663’ because it violates the following Content Security Policy directive: “img-src ‘self’ https: blob: data:”.

CSP:  
content=“default-src \* gap:; object-src ‘self’ blob:; connect-src ‘self’ blob: wss: https://_/_; img-src ‘self’ https: blob: data:; style-src ‘self’ ‘unsafe-inline’; script-src ‘self’ ‘unsafe-inline’”

If anyone can help I would be very appreciative.

Thanks

---

<div class="post-metadata">

**Author:** ![distante](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@distante](https://forum.ionicframework.com/u/distante)\
**Post date:** [November 23, 2016, 2:20pm UTC](https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957/2 "2016-11-23T14:20:46Z")

</div>

Hello, did you managed to fix this? I am having the same problem.

---

<div class="post-metadata">

**Author:** ![Hawkeye](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Hawkeye](https://forum.ionicframework.com/u/Hawkeye)\
**Post date:** [November 23, 2016, 6:08pm UTC](https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957/3 "2016-11-23T18:08:07Z")

</div>

To be honest, I completely forgot about this. I think I managed to fix it but cannot directly see what I did. Perhaps if you could post your CSP I could take a look through and see if anything jogs my memory. I can see that I upgraded my cordova-ios (4.1.1) and cordova-android (5.1.1) platforms. Not sure if that is linked.

---

<div class="post-metadata">

**Author:** ![distante](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@distante](https://forum.ionicframework.com/u/distante)\
**Post date:** [November 23, 2016, 6:28pm UTC](https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957/4 "2016-11-23T18:28:57Z")

</div>

I finally fix it adding `img-src 'self' blob:` to my `<meta http-equiv="Content-Security-Policy">` tag in index.html

---

<div class="post-metadata">

**Author:** ![Hawkeye](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@Hawkeye](https://forum.ionicframework.com/u/Hawkeye)\
**Post date:** [November 23, 2016, 6:30pm UTC](https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957/5 "2016-11-23T18:30:29Z")

</div>

Glad to hear you fixed it. I have ‘self’ in there as well. It’s just one of those annoying things.

---

<div class="post-metadata">

**Author:** ![distante](https://avatars.discourse-cdn.com/v4/letter/d/7ba0ec/32.png) [@distante](https://forum.ionicframework.com/u/distante)\
**Post date:** [November 23, 2016, 7:36pm UTC](https://forum.ionicframework.com/t/content-security-policy-refused-to-load-image/60957/6 "2016-11-23T19:36:00Z")

</div>

Yes, I have that too.  
Hopefully this thread will help others too!