# CSP for images via Jemoji

**URL:** <https://talk.jekyllrb.com/t/csp-for-images-via-jemoji/2699>\
**Category:** Help\
**Created:** [March 6, 2019, 5:13am UTC](https://talk.jekyllrb.com/t/csp-for-images-via-jemoji/2699 "2019-03-06T05:13:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisfinazzo](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/chrisfinazzo/32/561_2.png) [@chrisfinazzo](https://talk.jekyllrb.com/u/chrisfinazzo)\
**Post date:** [March 6, 2019, 5:13am UTC](https://talk.jekyllrb.com/t/csp-for-images-via-jemoji/2699/1 "2019-03-06T05:13:22Z")

</div>

I am using the Jemoji plugin to provide emoji on my site. I have a Content Security Policy that sets a number of HTTP headers in a `_headers` file. In a previous version of the plugin, these images were served from `assets-cdn.github.com`. In version, 0.10.2, this was changed to `https://github.githubassets.com/`, but for some reason the plugin still points to emoji from the prior URL and my images are blocked.

Does anyone know where I can change the URL where these images are coming from?

---

<div class="post-metadata">

**Author:** ![mmistakes](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/mmistakes/32/2169_2.png) [@mmistakes](https://talk.jekyllrb.com/u/mmistakes)\
**Post date:** [March 6, 2019, 5:25pm UTC](https://talk.jekyllrb.com/t/csp-for-images-via-jemoji/2699/2 "2019-03-06T17:25:58Z")

</div>

Can you verify you’re using version 0.10.2 in your `Gemfile`?  
According to this commit looks like everything was updated to `https://github.githubassets.com/`

> <https://github.com/jekyll/jemoji/commit/76e3052ac896e5c0a7ba1630c989cbfdfeca5951>

---

<div class="post-metadata">

**Author:** ![chrisfinazzo](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/chrisfinazzo/32/561_2.png) [@chrisfinazzo](https://talk.jekyllrb.com/u/chrisfinazzo)\
**Post date:** [March 7, 2019, 3:11am UTC](https://talk.jekyllrb.com/t/csp-for-images-via-jemoji/2699/3 "2019-03-07T03:11:50Z")

</div>

I had the wrong version constraint specified in my Gemfile, I’ve updated [this](https://github.com/chrisfinazzo/blog/commit/5831c0e11f97c1eae3d5c449e0bff1a83039172d), and `bundle show jemoji` returns the following path:

`/Users/Chris/.rbenv/versions/2.5.0/lib/ruby/gems/2.5.0/gems/jemoji-0.10.2`

That said, I still get 404’s on the posts where emoji are used. Using the updated assets baseurl returns the correct images, but I’m unclear about how to insert these into a post.

![37%20PM](https://canada1.discourse-cdn.com/flex030/uploads/jekyllrb/original/2X/1/11e91df1c9004c057911146c34c1e53089864a1e.png)

---

<div class="post-metadata">

**Author:** ![mmistakes](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.jekyllrb.com/mmistakes/32/2169_2.png) [@mmistakes](https://talk.jekyllrb.com/u/mmistakes)\
**Post date:** [March 7, 2019, 1:25pm UTC](https://talk.jekyllrb.com/t/csp-for-images-via-jemoji/2699/4 "2019-03-07T13:25:00Z")

</div>

You sure you’ve retriggered a build on your production server? Or maybe the HTML is being cached by your browser?

I just cloned your repo and built it locally and the paths seem correct to me.

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/jekyllrb/original/2X/3/3f2c625786dfa956b6fe1f7e49b92532f0804ac4.png)

![image](https://canada1.discourse-cdn.com/flex030/uploads/jekyllrb/original/2X/4/44d3abec786898c719fdde33a823d1c562695fa9.png)

```auto
<img class="emoji" title=":confounded:" alt=":confounded:" src="https://github.githubassets.com/images/icons/emoji/unicode/1f616.png" width="20" height="20">

```