CSP policy not working properly

Hello , I have read the documentaion over and over again and tried various thing but CSP policy is not allowing imgaes from imgur here is the code

app.use(
    helmet.contentSecurityPolicy({
        "default-src": ["'self'"],
        "base-uri": ["'self'"],
        "block-all-mixed-content": [],
        "font-src": ["'self'"],
       " frame-ancestors": ["'self'"],
       "img-src ["'self'", "https://imgur.com/"],
       " object-src": ["'none'"],
        "script-src": ["'self'"],
        "script-src-attr": ["'none'"],
       " style-src": ["'self'", "https: 'unsafe-inline'"],
        "upgrade-insecure-requests": []
    })
)

what am i doing wrong here??

[raukaute]

The reason why it is not working is the options object you are using. As stated in the documentation: options.directives is an object.

Or, if you prefer the raw code: (https://github.com/helmetjs/helmet/blob/cb170160e7c1ccac314cc19d3b979cfc771f1349/middlewares/content-security-policy/index.ts#L61)

I do think though this could be either pointed at more directly in the docs or print a warning when CSP is invoked with options object that doesn’t have the directives prop.

Hope that helped

[EvanHahn]

I think @BobbySpoon is right. In other words, you need to go from this:

helmet.contentSecurityPolicy({
  'default-src': [/* ... */],
  // ...
});

To this:

helmet.contentSecurityPolicy({
  directives: {
    'default-src': [/* ... */],
    // ...
  }
});

I’m going to close this issue because I think this solves your problem, but let me know if that’s wrong and I can reopen.