diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb
index 507719e1..5f83eb04 100644
--- a/lib/sinatra/base.rb
+++ b/lib/sinatra/base.rb
@@ -1691,6 +1691,10 @@ module Sinatra
       def setup_protection(builder)
         return unless protection?
         options = Hash === protection ? protection.dup : {}
+        options = {
+          img_src:  "'self' data:",
+          font_src: "'self'"
+        }.merge options
 
         protect_session = options.fetch(:session) { sessions? }
         options[:without_session] = !protect_session