From d191995840ae051389058786f0878a908b4ae9e4 Mon Sep 17 00:00:00 2001
From: Lawrence <32899150+lawrence-law@users.noreply.github.com>
Date: Sun, 16 Nov 2025 02:30:31 +1100
Subject: [PATCH] Update CSP to allow data URI images on OAuth screens (#2405)

* Update CSP to allow data URI images

* Fix formatting issue
---
 docs/python-sdk/fastmcp-utilities-ui.mdx | 2 +-
 src/fastmcp/server/auth/oauth_proxy.py   | 6 ++----
 src/fastmcp/utilities/ui.py              | 2 +-
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/docs/python-sdk/fastmcp-utilities-ui.mdx b/docs/python-sdk/fastmcp-utilities-ui.mdx
index a24ed03cf..09f5a425c 100644
--- a/docs/python-sdk/fastmcp-utilities-ui.mdx
+++ b/docs/python-sdk/fastmcp-utilities-ui.mdx
@@ -18,7 +18,7 @@ consent pages, and other user-facing interfaces.
 ### `create_page` <sup><a href="https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/utilities/ui.py#L453" target="_blank"><Icon icon="github" style="width: 14px; height: 14px;" /></a></sup>
 
 ```python
-create_page(content: str, title: str = 'FastMCP', additional_styles: str = '', csp_policy: str = "default-src 'none'; style-src 'unsafe-inline'; img-src https:; base-uri 'none'") -> str
+create_page(content: str, title: str = 'FastMCP', additional_styles: str = '', csp_policy: str = "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; base-uri 'none'") -> str
 ```
 
 
diff --git a/src/fastmcp/server/auth/oauth_proxy.py b/src/fastmcp/server/auth/oauth_proxy.py
index a1452378b..1998f4249 100644
--- a/src/fastmcp/server/auth/oauth_proxy.py
+++ b/src/fastmcp/server/auth/oauth_proxy.py
@@ -380,7 +380,7 @@ def create_consent_html(
         form_action_schemes.append(f"{redirect_scheme}:")
 
     form_action_directive = " ".join(form_action_schemes)
-    csp_policy = f"default-src 'none'; style-src 'unsafe-inline'; img-src https:; base-uri 'none'; form-action {form_action_directive}"
+    csp_policy = f"default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; base-uri 'none'; form-action {form_action_directive}"
 
     return create_page(
         content=content,
@@ -468,9 +468,7 @@ def create_error_html(
     )
 
     # Simple CSP policy for error pages (no forms needed)
-    csp_policy = (
-        "default-src 'none'; style-src 'unsafe-inline'; img-src https:; base-uri 'none'"
-    )
+    csp_policy = "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; base-uri 'none'"
 
     return create_page(
         content=content,
diff --git a/src/fastmcp/utilities/ui.py b/src/fastmcp/utilities/ui.py
index 2afe3e495..2ada4c83b 100644
--- a/src/fastmcp/utilities/ui.py
+++ b/src/fastmcp/utilities/ui.py
@@ -454,7 +454,7 @@ def create_page(
     content: str,
     title: str = "FastMCP",
     additional_styles: str = "",
-    csp_policy: str = "default-src 'none'; style-src 'unsafe-inline'; img-src https:; base-uri 'none'",
+    csp_policy: str = "default-src 'none'; style-src 'unsafe-inline'; img-src https: data:; base-uri 'none'",
 ) -> str:
     """
     Create a complete HTML page with FastMCP styling.