CSP error on gravatar #86

New issue

Closed

opened 2026-09-29 12:38:34 +00:00 by benjamin.broersma · 1 comment

benjamin.broersma commented

2026-09-29 12:38:34 +00:00

See https://code.overheid.nl/ForumStandaardisatie/beslisboom-open-standaarden and my user image, which is loaded from gravitar, but disallowed/blocked by the CSP:

Loading the image 'https://secure.gravatar.com/avatar/824175c3b86324f07d0dde52f8f8cb30de6d3fc72b6af77c5d097f5d3dbaf44c?d=identicon' violates the following Content Security Policy directive: "img-src 'self' data: blob:". The action has been blocked

Two options:

Disable gravatar, the only reference is in some config-cheat-sheet that still references the Gitea version of when the config parameter got deprecated, it should be possible to change it in the admin panel:

DISABLE_GRAVATAR: false: Enable this to use local avatars only. DEPRECATED [v1.18+] moved to the database. Use the admin panel to configure.
Allow gravatar by adding https://secure.gravatar.com/avatar/ to img-src

See https://code.overheid.nl/ForumStandaardisatie/beslisboom-open-standaarden and my user image, which is loaded from gravitar, but disallowed/blocked by the CSP: ```none Loading the image 'https://secure.gravatar.com/avatar/824175c3b86324f07d0dde52f8f8cb30de6d3fc72b6af77c5d097f5d3dbaf44c?d=identicon' violates the following Content Security Policy directive: "img-src 'self' data: blob:". The action has been blocked ``` Two options: 1. Disable gravatar, the only reference is in some [config-cheat-sheet](https://forgejo.org/docs/latest/admin/config-cheat-sheet/#picture-picture) that still references the Gitea version of when the config parameter got deprecated, it should be possible to change it in the admin panel: > **`DISABLE_GRAVATAR`: false**: Enable this to use local avatars only. **DEPRECATED [v1.18+]** moved to the database. Use the admin panel to configure. 2. Allow gravatar by adding `https://secure.gravatar.com/avatar/` to `img-src` Related: - #11 - #26 - #43

benjamin.broersma changed title from ~~CSP error on gravatargravatar~~ to CSP error on gravatar

2026-09-29 12:38:42 +00:00