---
title: "Content Security Policy"
manual: "Imaginator"
version: "1.0"
permalink: "https://docs.typo3.org/permalink/schliesser/imaginator:configuration-csp@1.0"
source: "Configuration/Csp.rst"
rendered: "2026-10-13T11:21:40+00:00"
---

# Content Security Policy {#configuration-csp}

## The placeholder (LQIP) {#the-placeholder-lqip}

The placeholder is **not** rendered as an inline `style=""` attribute
(those cannot carry a CSP nonce). The `<img>` only gets a CSS class; the
actual rule is registered through TYPO3's `AssetCollector` and emitted as a
nonced `<style>` element. Identical placeholders are deduplicated to a
single rule.

Depending on the chosen [lqip](https://docs.typo3.org/permalink/schliesser/imaginator:confval-conf-lqip@1.0) option:

-   **`thumbhash` (default)**

    The blurred preview is a `data:` background image, so allow
    `img-src data:` (TYPO3's default frontend CSP already does).

-   **`dominant-color`**

    A plain background color. Needs nothing beyond the nonced/hashed `<style>`

-   **`none`**

    No placeholder, no extra directive.

## The `sizes="auto"` polyfill {#the-sizes-auto-polyfill}

Whenever a processed image renders, Imaginator registers the
[sizes="auto" polyfill](https://docs.typo3.org/permalink/schliesser/imaginator:introduction-sizes-auto@1.0) through the
`AssetCollector`. It is a same-origin script file, nonce-tagged so a strict
policy accepts it (TYPO3 v14 via `csp`, v13 via `useNonce`).

So a strict CSP needs to allow the nonced script under `script-src`, TYPO3's
default frontend CSP nonces scripts automatically, so nothing extra is required.
If you maintain a custom policy, make sure `script-src` permits same-origin
nonced scripts (e.g. `script-src 'self' 'nonce-…'`).

Pages without any `<i:image>` register no script at all.