const BLOB_CONTENT_SECURITY_POLICY: &str = "default-src 'none'; sandbox";Expand description
The content security policy every com.atproto.sync.getBlob answer
carries.
A blob is bytes an account uploaded, served from the same origin as
/dashboard. An HTML or SVG blob opened in a browser would otherwise run
its script as this origin, and a fetch from there carries the
dashboard’s session cookie. sandbox gives the page an origin of its
own, and default-src 'none' lets it load nothing. An <img> on another
page is not bound by it, so an avatar still shows.