I have a document which is simply:
<html>
<head><title>Hi</title></head>
<body>
<svg><use href="icons-nav-main.svg#icon-messages"></use></svg>
</body>
</html>
In my content-security-policy I have set the default to allow nothing but allowed everything else:
Content-Security-Policy: default-src 'none';
base-uri 'none';
connect-src 'self';
font-src 'self';
frame-src 'self';
img-src 'self';
manifest-src 'self';
media-src 'self';
object-src 'self';
script-src 'self';
style-src 'self';
worker-src 'self';
Firefox won’t display the SVG, saying
Content Security Policy: The page's settings blocked the loading of a resource at <url>/icons-nav-main.svg ("default-src").
It displays fine in Chrome and friends though.
Is there another CSP clause I should apply to get this working?
