title: CSP Blocking images from S3
body: <p>I have a client that uploads an image to the server, then, the server takes that image and uploads it to S3, waits for the URL and then return the URL for that image.</p>
  
  <p>The problem is that for some reason, the client refuses to load the image provided by the server</p>
  
  <p>In the console this is the message that I get (removed actual URL for privacy reasons):
  <em>Refused to load the image '<strong>URL</strong>' because it violates the following Content Security Policy directive: "img-src 'self' data:".</em></p>
  
  <p>The image is uploaded with all read permissions, so anyone can read the url.</p>
  
  <p>The CSP in the HTML is like this:</p>
  
  <p><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src *; img-src * 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; style-src  'self' 'unsafe-inline' *"&gt;</code></p>
  
  <p>I must say that I'm passing to the client the URL that was created by amazon. eg:</p>
  
  <p><code>https://mybucket.s3.us-west-2.amazonaws.com/ecc6898f-56b1-4ad1-bb73-3b5c9749d264.jpeg</code></p>