diff --git a/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php b/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
index 1b9ad019a..85fd5c23f 100644
--- a/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
+++ b/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
@@ -8,6 +8,7 @@ namespace SnappyMail\HTTP;
 class CSP
 {
 	public
+		$base = ["'self'"],
 		$default = ["'self'"],
 		// Knockout.js requires unsafe-inline?
 		// Knockout.js requires eval() for observable binding purposes
@@ -34,6 +35,7 @@ class CSP
 	function __toString() : string
 	{
 		$params = [
+			'base-uri ' . \implode(' ', $this->base),
 			'default-src ' . \implode(' ', $this->default)
 		];
 		if ($this->script) {