ssume a <code>Content-Security-Policy</code> header is set with the following policy:</p>
<pre>
img-src 'self' https://images.example.com;
</pre>
<h4>Allows</h4>
<p>With the above CSP policy, images can be loaded from the same origin (via the 'self' source list value), or via URLs starting with: <code>https://images.example.com</code>
<pre>
&lt;img src="/images/me.jpg"&gt;
&lt;img src="https://images.example.com/photo.jpg"&gt;
</pre>
<h4>Blocks</h4>
<p>The above policy will block any image not same origin o