Leandro Martins

> Was this fixed by #3245? I'm running a registry in EKS now and not seeing it take on the IRSA role. I'm also facing the same issue.

> @leandrocostam We had the same issue. To avoid it you can put: "example.com" instead of "https://example.com" in Content-Security-Policy. It works in the same way Yes, that works when you...

Also, there are cases where you can have the following CSP policy block: ``` img-src 'self' data: blob: ``` It also breaks the response-rewrite plugin

We are using the `headers.set` as a workaround for now. By checking the code, it's a different validation and it's not breaking the plugin.