It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: https://developer.mozilla.org/en-US/docs/Web/HT

It might work (though I'm not completely sure) if you specify a hash in the img-src directive of the CSP header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co... Another option would be to just use a subresource-integrity protected script to check the hash of a downloaded image/video before displaying it.