Describe the solution you'd like
Currently images are directly embedded in the browser from cdn-images.dzcdn.net
Depending on the webserver (header) configuration those could leak the referrer (original domain opened i.e.: deemix.example.com) to deezer or be blocked and do not work at all.
content security policy header: img-src 'self' data: blob:
Blocks the needed requests to external resources, which breaks the ui.
leaking the referrer may impose a risk to users as this could be reviewed and audited by deezer easily.
with that deezer can quickly identify accounts that do not comply with their ToS and terminate them.
having the browser embed the images via dzcdn leaks the user ips and what they look at.
I would like to have the option for deemix to fetch those images itself, cache them and serve them directly.
That way images can be loaded through the service directly under deemix.example.com and work with strict CSP.
Describe alternatives you've considered
Additional context
Describe the solution you'd like
Currently images are directly embedded in the browser from
cdn-images.dzcdn.netDepending on the webserver (header) configuration those could leak the referrer (original domain opened i.e.:
deemix.example.com) to deezer or be blocked and do not work at all.content security policy header:
img-src 'self' data: blob:Blocks the needed requests to external resources, which breaks the ui.
leaking the referrer may impose a risk to users as this could be reviewed and audited by deezer easily.
with that deezer can quickly identify accounts that do not comply with their ToS and terminate them.
having the browser embed the images via dzcdn leaks the user ips and what they look at.
I would like to have the option for deemix to fetch those images itself, cache them and serve them directly.
That way images can be loaded through the service directly under
deemix.example.comand work with strict CSP.Describe alternatives you've considered
Additional context