# CSP issues in r134+

**URL:** <https://discourse.threejs.org/t/csp-issues-in-r134/45092>\
**Category:** Questions\
**Tags:** loaders\
**Created:** [November 24, 2022, 11:54am UTC](https://discourse.threejs.org/t/csp-issues-in-r134/45092 "2022-11-24T11:54:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![axel523](https://avatars.discourse-cdn.com/v4/letter/a/f08c70/32.png) [@axel523](https://discourse.threejs.org/u/axel523)\
**Post date:** [November 24, 2022, 11:54am UTC](https://discourse.threejs.org/t/csp-issues-in-r134/45092/1 "2022-11-24T11:54:48Z")

</div>

Hi!  
I’m using the GLTFLoader to load to .gltf objects in a scene, but they are blocked by connect-src rules I have implemented. By adding ‘data:’ in the connect-src allowlist, the files are loaded correctly, but ‘data:’ is a risk for XSS which I wish to avoid at most costs, does anyone know of a way around this?  
The ‘data:’ -source was not necessary prior to r134 so I assume it came from changing the FileLoader API from XMLHttpRequest() to fetch()([Migration Guide · mrdoob/three.js Wiki · GitHub](https://github.com/mrdoob/three.js/wiki/Migration-Guide#133--134)).

" \* `data:` Allows [`data:` URLs](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URLs) to be used as a content source. _This is insecure; an attacker can also inject arbitrary `data:` URLs. Use this sparingly and definitely not for scripts._"  
source: [CSP source values - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources)

---

<div class="post-metadata">

**Author:** ![Mugen87](https://yyz1.discourse-cdn.com/flex035/user_avatar/discourse.threejs.org/mugen87/32/5645_2.png) [@Mugen87](https://discourse.threejs.org/u/Mugen87)\
**Post date:** [November 24, 2022, 12:14pm UTC](https://discourse.threejs.org/t/csp-issues-in-r134/45092/2 "2022-11-24T12:14:48Z")

</div>

> [@axel523](#):
>
> so I assume it came from changing the FileLoader API from XMLHttpRequest() to fetch

Can you make a test with `OBJLoader`? This loader uses no data URLs so if it works the issue is not related to `fetch` in general.