title: How to set font-face data: in a Content Security Policy meta tag?
body: <p>I am using a very small embedded font in a CSS file like so:</p>
  
  <pre><code>@font-face {
      font-family: 'fontello';
      src: url('data:application/octet-stream;base64,...');
  }
  </code></pre>
  
  <p>But upon loading the page in Chrome, I get this error in the console, and the font is not loading.</p>
  
  <blockquote>
    <p>Refused to load the font 'data:application/octet-stream;base64,...' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'font-src' was not explicitly set, so 'default-src' is used as a fallback.</p>
  </blockquote>
  
  <p>I am using the following <code>meta</code> tags: </p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src 'self'; font-src data:" /&gt;
  &lt;meta http-equiv="X-Content-Security-Policy" content="default-src 'self'; font-src data:" /&gt;
  &lt;meta http-equiv="X-WebKit-CSP" content="default-src 'self'; font-src data:" /&gt;
  </code></pre>
  
  <p>I did some research on CSP and the <code>meta</code> tags I've added seem like they should work, but so far nothing has changed. I explicity set <code>font-src</code> and yet the error message say that I haven't. What am I doing wrong?</p>