As a follow-up to #977
User avatars are currently served from the target account's subdomain--which could be any valid account name and which can also represent third-party/untrusted apps. This forces apps that want to display user account avatars to allow any subdomain img-src in their CSP, which can lead to exfiltration methods if XSS is achieved. (See further explanation in #1935.)
Instead, we should serve (proxy?) these from the profiles app subdomain. In that way, app CSPs can trust profiles (a system app) instead of arbitrary third parties.
As a follow-up to #977
User avatars are currently served from the target account's subdomain--which could be any valid account name and which can also represent third-party/untrusted apps. This forces apps that want to display user account avatars to allow any subdomain
img-srcin their CSP, which can lead to exfiltration methods if XSS is achieved. (See further explanation in #1935.)Instead, we should serve (proxy?) these from the
profilesapp subdomain. In that way, app CSPs can trustprofiles(a system app) instead of arbitrary third parties.