diff --git a/controllers/common.php b/controllers/common.php
index 35a18aa..9af1421 100644
--- a/controllers/common.php
+++ b/controllers/common.php
@@ -48,7 +48,7 @@ Router\before(function($action) {
     // HTTP secure headers
     Response\csp(array(
         'media-src' => '*',
-        'img-src' => '*',
+        'img-src' => '* data:',
         'frame-src' => Model\Config\get_iframe_whitelist(),
         'referrer' => 'no-referrer',
     ));