Packagist uses strict content cross-domain policy sending 'Content-Security-Policy' response header to the browser. At the present state this header contains following value:
default-src 'self';
block-all-mixed-content;
connect-src 'self' *.algolia.net *.algolianet.com;
font-src 'self' https://fonts.gstatic.com/;
img-src 'self' https://www.gravatar.com/ https://camo.githubusercontent.com/ https://user-images.githubusercontent.com/ https://raw.githubusercontent.com/ https://raw.github.com/ https://github.com/ https://gitlab.com/ https://ssl.google-analytics.com/ http://www.google-analytics.com/;
script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net/ https://ssl.google-analytics.com/;
style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/ https://fonts.googleapis.com/
It allows 'https://github.com/', 'https://camo.githubusercontent.com/, but it does not allow 'https://avatars*.githubusercontent.com'. Thus any reference of user or organization avatars inside 'readme.md' file creates a broken image at 'packagist.org'.
In particular, I use my GitHub organization avatar as a logo inside 'readme.md' files for my repositories.
For example:
https://github.com/yii2tech/ar-softdelete
embedds image via following code:
<img src="https://avatars2.githubusercontent.com/u/12951949" height="100px">
which produces broken image at 'packagist.org':
https://packagist.org/packages/yii2tech/ar-softdelete
I suppose contributors' avatar may also appear at 'readme.md' for some projects.
It would be nice if 'Content-Security-Policy' header includes 'https://avatars*.githubusercontent.com' or even 'https://*.githubusercontent.com' entry.
Packagist uses strict content cross-domain policy sending 'Content-Security-Policy' response header to the browser. At the present state this header contains following value:
It allows 'https://github.com/', 'https://camo.githubusercontent.com/, but it does not allow 'https://avatars*.githubusercontent.com'. Thus any reference of user or organization avatars inside 'readme.md' file creates a broken image at 'packagist.org'.
In particular, I use my GitHub organization avatar as a logo inside 'readme.md' files for my repositories.
For example:
https://github.com/yii2tech/ar-softdelete
embedds image via following code:
which produces broken image at 'packagist.org':
https://packagist.org/packages/yii2tech/ar-softdelete
I suppose contributors' avatar may also appear at 'readme.md' for some projects.
It would be nice if 'Content-Security-Policy' header includes 'https://avatars*.githubusercontent.com' or even 'https://*.githubusercontent.com' entry.