[Self-Hosted] Branding asset URLs configured in "Public App Identity" are blocked by img-src CSP

Summary

The Public App Identity settings allow administrators to configure branding assets using URLs, including:

• Icon URL
• Symbol URL
• Logo URL
• Wordmark URL
• Favicon URL

The configured URLs are accepted and stored correctly. However, if a branding asset is hosted on a different origin (for example the parent domain https://example.com while the Fluxer instance itself runs on https://chat.example.com), the asset is blocked by Fluxer's own img-src Content Security Policy. As a result, the configured branding is never displayed and the default Fluxer branding remains visible. This report is not about general CSP customization, LiveKit, Cloudflare Turnstile, custom themes or loading arbitrary third-party resources. It specifically concerns the official Public App Identity branding feature. The current behavior is inconsistent because the admin UI accepts and stores branding asset URLs which are subsequently blocked by the frontend through its own Content Security Policy. Using a parent domain to host shared branding assets is a common deployment pattern for self-hosted services. For example:

• https://example.com
• https://chat.example.com
• https://cloud.example.com
• https://status.example.com

In this scenario the branding assets belong to the same deployment and are not unrelated third-party resources. Before opening this report I searched through the existing CSP-related issues and discussions. The existing reports I found mainly concern:

• LiveKit (connect-src)
• Cloudflare Turnstile (script-src / frame-src)
• Custom themes
• General CSP configuration

I could not find an existing report specifically covering the official Public App Identity branding feature.

Steps to reproduce

1. Deploy a self-hosted Fluxer instance on a subdomain.

Example: https://chat.example.com

2. Host a branding asset on the parent domain.

Example: https://example.com/assets/branding/favicon.ico

3. Open:

Admin → Instance Configuration → Public App Identity

4. Set the Favicon URL to the URL above.

5. Save the configuration.

6. Reload the login page.

7. Open the browser developer console.

8. Observe that the favicon is not loaded and the browser reports an img-src Content Security Policy violation.

Environment

Deployment: Docker Compose Operating System: AlmaLinux 9 Browser: Firefox 151

Logs or screenshots

image image image image The browser reports the following CSP violation: The favicon itself is publicly accessible and loads correctly when opened directly in the browser. Fluxer stores the configured URL successfully, but the browser blocks the request because the parent domain is not included in the generated img-src CSP.