Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: Custom avatar shows broken image in Control UI after v2026.4.24 (CSP blob: URL blocked) [1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#71979•Fetched 2026-04-27 05:36:33
View on GitHub
Comments
1
Participants
2
Timeline
2
Reactions
0
Author
wangzihe843-hashwangzihe843-hash
Participants
clawsweeper[bot]clawsweeper[bot]wangzihe843-hashwangzihe843-hash
Timeline (top)
closed ×1commented ×1

Avatar image shows as broken placeholder in Control UI after updating to v2026.4.24. The 401 error is fixed, but a new CSP (Content Security Policy) bug blocks the avatar from displaying.

Error Message

Avatar image shows as broken placeholder in Control UI after updating to v2026.4.24. The 401 error is fixed, but a new CSP (Content Security Policy) bug blocks the avatar from displaying. 2. Tried resizing to 256x256 JPG — same CSP error v2026.4.24 changed how avatar images are served in the Control UI — they are now converted to blob: URLs in the browser. The CSP header img-src does not include blob: as an allowed origin, so the browser blocks the image from loading. This is a regression introduced alongside the fix for the 401 error in v2026.4.22/4.23.

Root Cause

Possible root cause

v2026.4.24 changed how avatar images are served in the Control UI — they are now converted to blob: URLs in the browser. The CSP header img-src does not include blob: as an allowed origin, so the browser blocks the image from loading. This is a regression introduced alongside the fix for the 401 error in v2026.4.22/4.23.

Fix Action

Fix / Workaround

Workarounds attempted

  1. Tried both PNG and JPG formats — both blocked by CSP
  2. Tried resizing to 256x256 JPG — same CSP error
  3. Hard refresh (Ctrl+Shift+R) — no effect
  4. Converting to data: URL did not apply to all UI elements
  5. Reverting to v2026.4.21 is the only current workaround

Code Example

Loading the image 'blob:http://localhost:18789/<UUID>' violates the following 
Content Security Policy directive: "img-src 'self' data:". 
The action has been blocked.

---

img-src 'self' data: blob:;
RAW_BUFFERClick to expand / collapse

Bug type

Control UI / avatar rendering (regression in v2026.4.24)

Beta release blocker

No

Summary

Avatar image shows as broken placeholder in Control UI after updating to v2026.4.24. The 401 error is fixed, but a new CSP (Content Security Policy) bug blocks the avatar from displaying.

Steps to reproduce

  1. Set a custom avatar image in IDENTITY.md (e.g. Avatar: avatars/avatar.png)
  2. Update to v2026.4.24
  3. Open Control UI at http://127.0.0.1:18789
  4. Observe the avatar — it appears as a broken image placeholder (not the custom image)

Expected behavior

Custom avatar image should display in the Control UI chat interface.

Actual behavior

Browser console shows repeated CSP violations:

Loading the image 'blob:http://localhost:18789/<UUID>' violates the following 
Content Security Policy directive: "img-src 'self' data:". 
The action has been blocked.

The avatar shows as a broken image placeholder. The browser converts the avatar to a blob: URL, but the CSP img-src policy only allows 'self' and data:, blocking blob: origins.

OpenClaw version

v2026.4.24 (cbcfdf6)

Operating system

Windows 11 (x64)

Workarounds attempted

  1. Tried both PNG and JPG formats — both blocked by CSP
  2. Tried resizing to 256x256 JPG — same CSP error
  3. Hard refresh (Ctrl+Shift+R) — no effect
  4. Converting to data: URL did not apply to all UI elements
  5. Reverting to v2026.4.21 is the only current workaround

Possible root cause

v2026.4.24 changed how avatar images are served in the Control UI — they are now converted to blob: URLs in the browser. The CSP header img-src does not include blob: as an allowed origin, so the browser blocks the image from loading. This is a regression introduced alongside the fix for the 401 error in v2026.4.22/4.23.

Suggested fix

Add blob: to the img-src CSP directive in Control UI HTTP response headers, e.g.:

img-src 'self' data: blob:;

Or serve avatar images from a named HTTP endpoint rather than a blob: URL to avoid the CSP restriction entirely.

extent analysis

TL;DR

Update the Content Security Policy (CSP) img-src directive to include blob: to allow avatar images to load.

Guidance

  • Verify the current CSP header in the HTTP response from the Control UI server to confirm the img-src directive does not include blob:.
  • Update the CSP header to include blob: in the img-src directive, for example: img-src 'self' data: blob:;.
  • Alternatively, consider serving avatar images from a named HTTP endpoint instead of using blob: URLs to avoid CSP restrictions.
  • Test the updated CSP configuration or new image serving approach to ensure avatar images display correctly in the Control UI.

Example

HTTP/1.1 200 OK
Content-Security-Policy: img-src 'self' data: blob:;

Notes

This fix assumes that the issue is solely due to the CSP restriction and that updating the img-src directive will resolve the problem. Serving avatar images from a named HTTP endpoint may require additional changes to the application's image handling logic.

Recommendation

Apply the workaround by updating the CSP img-src directive to include blob:, as this is a straightforward fix that directly addresses the identified issue.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Custom avatar image should display in the Control UI chat interface.

#output truncation#response parsing#generation error#database connection#vector store

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING