title: Content security policy blocking remote CSS background image
body: <p>A background image loaded from a remote server is being blocked by my CSP with the message</p>
  
  <blockquote>
    <p>Content Security Policy: The page's settings blocked the loading of a
    resource at self ("default-src * <a href="https://xxxxx.com" rel="noreferrer">https://xxxxx.com</a>"). Source:
    background-image: url('<a href="https://xxxxx" rel="noreferrer">https://xxxxx</a>....</p>
  </blockquote>
  
  <p>Here's my CSP:</p>
  
  <pre><code>&lt;meta http-equiv="Content-Security-Policy" content="default-src * https://xxxxx.com; script-src * 'unsafe-eval' 'unsafe-inline'; img-src 'self' data:"&gt;
  </code></pre>
  
  <p>...where <code>xxxxx</code> is obviously my domain.</p>
  
  <p>I assume it doesn't like <code>url(...</code>, but the <a href="https://content-security-policy.com/" rel="noreferrer">CSP spec</a> doesn't seem to consider <code>url()</code> a scheme so I can't see what to do about this. Anyone know?</p>
  
  <p>[UPDATE]</p>
  
  <p>Following @sideshowbarker's comment, I should have pointed out that this call is coming from an inline <code>style</code> attribute (not tag).</p>