I am also using CustomUI and making use of the ‘@atlaskit/avatar’ component:
<Avatar appearance="circle" src="https://secure.gravatar.com/avatar/bd311dd52b9c5d3667b0b34f72959007?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FBJ-0.png" size="large" />
The image url is retrieved from the users.avatarUrls from the Atlassian rest API. The problem is the following:
Refused to load the image 'https://secure.gravatar.com/avatar/bd311dd52b9c5d3667b0b34f72959007?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FBJ-0.png' because it violates the following Content Security Policy directive: "img-src 'self' data: blob: https://avatar-management--avatars.us-west-2.prod.public.atl-paas.net".
I am using the standard Content security policy from the Atlassian CustomUI - Todo app - example:
<meta http-equiv="Content-Security-Policy" content="style-src 'self' 'unsafe-inline'" />
@danielwinterw any solutions in place at the moment?