Search code examples
ruby-on-railscontent-security-policyrails-activestorage

CSP: Relative img src on https site tries to link to http image

I have a site on HTTPS and i am linking to images with relative links. I am generating the link with a rails helper

 <%= image_tag url_for(screenshot.attachment) %>

Which produces an image tag like

<img src="/rails/blobs/myimage.jpg"/>

Although the site is on HTTPS and i am using a relative path, i get the following CSP error

Refused to load the image 'http://example.com/rails/blobs/myimage.jpg?content_type=image%2Fjpeg&disposition=inline%3B+filename%3D%22screenshot.jpg%22%3B+filename%2A%3DUTF-8%27%27screenshot.jpg' 
because it violates the following Content Security Policy directive: "img-src 'self' https: data:".

I don't understand why it is trying to load the image from HTTP.

Solution

  • From your nginx config have to do https forwarding. Then this problem will take care.