  Measurement-device-independent quantum key distribution (MDI-QKD), which is
immune to all detector side-channel attacks, is the most promising solution to
the security issues in practical quantum key distribution systems. Though
several experimental demonstrations of MDI QKD have been reported, they all
make one crucial but not yet verified assumption, that is there are no flaws in
state preparation. Such an assumption is unrealistic and security loopholes
remain in the source. Here we present, to our knowledge, the first MDI-QKD
experiment with state preparation flaws taken into consideration. By applying a
novel security proof by Tamaki \textit{et al} (Phys. Rev. A 90, 052314 (2014)),
we distribute secure keys over fiber links up to 40 km with imperfect sources,
which would not have been possible under previous security proofs. By closing
loopholes in both the sources and the detectors, our work shows the feasibility
of secure QKD with practical imperfect devices.
