W3cubDocs

/HTTP

Content-Security-Policy

The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).

For more information, see the introductory article on Content Security Policy (CSP).

Syntax

Content-Security-Policy: <policy-directive>; <policy-directive>

where <policy-directive> consists of: <directive> <value> with no internal punctuation.

Directives

Fetch directives

Fetch directives control the locations from which certain resource types may be loaded.

child-src

Defines the valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>.

Instead of child-src, if you want to regulate nested browsing contexts and workers, you should use the frame-src and worker-src directives, respectively.

connect-src
Restricts the URLs which can be loaded using script interfaces
default-src
Serves as a fallback for the other fetch directives.
font-src
Specifies valid sources for fonts loaded using @font-face.
frame-src
Specifies valid sources for nested browsing contexts loading using elements such as <frame> and <iframe>.
img-src
Specifies valid sources of images and favicons.
manifest-src
Specifies valid sources of application manifest files.
media-src
Specifies valid sources for loading media using the <audio> , <video> and <track> elements.
object-src
Specifies valid sources for the <object>, <embed>, and <applet> elements.
Elements controlled by object-src are perhaps coincidentally considered legacy HTML elements and are not receiving new standardized features (such as the security attributes sandbox or allow for <iframe>). Therefore it is recommended to restrict this fetch-directive (e.g., explicitly set object-src 'none' if possible).
prefetch-src
Specifies valid sources to be prefetched or prerendered.
script-src
Specifies valid sources for JavaScript.
script-src-elem
Specifies valid sources for JavaScript <script> elements.
script-src-attr
Specifies valid sources for JavaScript inline event handlers.
style-src
Specifies valid sources for stylesheets.
style-src-elem
Specifies valid sources for stylesheets <style> elements and <link> elements with rel="stylesheet".
style-src-attr
Specifies valid sources for inline styles applied to individual DOM elements.
worker-src
Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.

Document directives

Document directives govern the properties of a document or worker environment to which a policy applies.

base-uri
Restricts the URLs which can be used in a document's <base> element.
plugin-types
Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.
sandbox
Enables a sandbox for the requested resource similar to the <iframe> sandbox attribute.

Navigation directives govern to which locations a user can navigate or submit a form, for example.

form-action
Restricts the URLs which can be used as the target of a form submissions from a given context.
frame-ancestors
Specifies valid parents that may embed a page using <frame>, <iframe>, <object>, <embed>, or <applet>.
navigate-to
Restricts the URLs to which a document can initiate navigation by any means, including <form> (if form-action is not specified), <a>, window.location, window.open, etc.

Reporting directives

Reporting directives control the reporting process of CSP violations. See also the Content-Security-Policy-Report-Only header.

report-uri
Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

Though the report-to directive is intended to replace the deprecated report-uri directive, report-to is not supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get report-to support, you can specify both report-uri and report-to:

Content-Security-Policy: ...; report-uri https://endpoint.example.com; report-to groupname

In browsers that support report-to, the report-uri directive will be ignored.

report-to
Fires a SecurityPolicyViolationEvent.

Other directives

block-all-mixed-content
Prevents loading any assets using HTTP when the page is loaded using HTTPS.
referrer
Used to specify information in the Referer (sic) header for links away from a page. Use the Referrer-Policy header instead.
require-sri-for
Requires the use of SRI for scripts or styles on the page.
require-trusted-types-for
Enforces Trusted Types at the DOM XSS injection sinks.
trusted-types
Used to specify an allow-list of Trusted Types policies. Trusted Types allows applications to lock down DOM XSS injection sinks to only accept non-spoofable, typed values in place of strings.
upgrade-insecure-requests
Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.

CSP in workers

Workers are in general not governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a Content-Security-Policy response header for the request which requested the worker script itself.

The exception to this is if the worker script's origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker that created it.

Multiple content security policies

The CSP mechanism allows multiple policies being specified for a resource, including via the Content-Security-Policy header, the Content-Security-Policy-Report-Only header and a <meta> element.

You can use the Content-Security-Policy header more than once, as in the example below. Pay special attention to the connect-src directive here. Even though the second policy would allow the connection, the first policy contains connect-src 'none'. Adding additional policies can only further restrict the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, connect-src 'none' is enforced.

Content-Security-Policy: default-src 'self' http://example.com;
                         connect-src 'none';
Content-Security-Policy: connect-src http://example.com/;
                         script-src http://example.com/

Examples

Example: Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https:

// header
Content-Security-Policy: default-src https:

// meta tag
<meta http-equiv="Content-Security-Policy" content="default-src https:">

Example: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over HTTPS and to disable plugins:

Content-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'

Example: Do not implement the above policy yet; instead just report violations that would have occurred:

Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

See Mozilla Web Security Guidelines for more examples.

Specifications

Specification Status Comment
Content Security Policy Level 3 Working Draft Adds manifest-src, navigate-to, report-to, strict-dynamic, worker-src. Undeprecates frame-src. Deprecates report-uri in favor if report-to.
Mixed Content Candidate Recommendation Adds block-all-mixed-content.
Subresource Integrity Recommendation Adds require-sri-for.
Upgrade Insecure Requests Candidate Recommendation Adds upgrade-insecure-requests.
Content Security Policy Level 2 Recommendation Adds base-uri, child-src, form-action, frame-ancestors, plugin-types, referrer, and report-uri. Deprecates frame-src.
Content Security Policy 1.0 Obsolete Defines connect-src, default-src, font-src, frame-src, img-src, media-src, object-src, report-uri, sandbox, script-src, and style-src.

Browser compatibilityUpdate compatibility data on GitHub

Desktop
Chrome Edge Firefox Internet Explorer Opera Safari
Content-Security-Policy 25
25
14
Uses the non-standard name: X-Webkit-CSP
14 23
23
4
Uses the non-standard name: X-Content-Security-Policy
10
10
Only supporting 'sandbox' directive.
Uses the non-standard name: X-Content-Security-Policy
15 7
7
6
Uses the non-standard name: X-Webkit-CSP
base-uri 40 79 35 No 27 10
block-all-mixed-content Yes ≤79 48 No Yes ?
child-src 40 15 45 No 27 10
connect-src 25 14 23
23
Prior to Firefox 50, ping attributes of <a> elements weren't covered by connect-src.
No 15 7
default-src 25 14 23 No 15 7
font-src 25 14 23 No 15 7
form-action 40 15 36 No 27 10
frame-ancestors 40 15 33
33
Before Firefox 58, frame-ancestors is ignored in Content-Security-Policy-Report-Only.
No 26 10
frame-src 25 14 23 No 15 7
img-src 25 14 23 No 15 7
manifest-src Yes 79 41 No Yes No
media-src 25 14 23 No 15 7
<meta> element support Yes ≤18 45 No Yes Yes
navigate-to No No No No No No
object-src 25 14 23 No 15 7
plugin-types 40 15 No
No
See bug 1045899.
No 27 10
prefetch-src No
No
See bug 801561.
No
No
See bug 801561.
No
No
See bug 1457204.
No No No
No
See bug 185070.
referrer 33 — 56 No 37 — 62 No ? — 43 No
report-sample 59 ≤79 ? ? 46 ?
report-to 70 79 No No No No
report-uri 25 14 23 No 15 7
require-sri-for 54 79 49 — 68
Disabled
49 — 68
Disabled
Disabled From version 49 until version 68 (exclusive): this feature is behind the security.csp.experimentalEnabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
No 41 No
sandbox 25 14 50 10 15 7
script-src 25 14 23 No 15 7
script-src-attr 75 79 No
No
See bug 1529337.
No 62 No
script-src-elem 75 79 No
No
See bug 1529337.
No 62 No
strict-dynamic 52 79 52 No 39 No
style-src 25 14 23 No 15 7
style-src-attr 75 79 No
No
See bug 1529338.
No 62 No
style-src-elem 75 79 No
No
See bug 1529338.
No 62 No
trusted-types 83
83
73 — 76
Disabled
Disabled From version 73 until version 76 (exclusive): this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
? No No No No
unsafe-hashes 69 79 No
No
See bug 1343950.
No 56 No
upgrade-insecure-requests 43 17 42 No 30 10.1
Worker support Yes ≤79 50 No ? 10
worker-src 59
59
Chrome 59 and higher skips the deprecated child-src directive.
79 58 No 48 No
Mobile
Android webview Chrome for Android Firefox for Android Opera for Android Safari on iOS Samsung Internet
Content-Security-Policy Yes Yes 23 Yes 7
7
5.1
X-Webkit-CSP
Yes
base-uri Yes Yes 35 ? 9.3 Yes
block-all-mixed-content Yes Yes 48 ? ? Yes
child-src Yes Yes 45 ? 9.3 Yes
connect-src Yes Yes 23 ? 7 Yes
default-src Yes Yes 23 ? 7 Yes
font-src Yes Yes 23 ? 7 Yes
form-action Yes Yes 36 ? 9.3 Yes
frame-ancestors ? Yes 33
33
Before Firefox for Android 58, frame-ancestors is ignored in Content-Security-Policy-Report-Only.
? 9.3 Yes
frame-src Yes Yes 23 ? 7 Yes
img-src Yes Yes 23 ? 7 Yes
manifest-src Yes Yes 41 ? No Yes
media-src Yes Yes 23 ? 7 Yes
<meta> element support Yes Yes 45 Yes Yes Yes
navigate-to No No No No No No
object-src Yes Yes 23 ? 7 Yes
plugin-types Yes Yes No ? 9.3 Yes
prefetch-src No
No
See bug 801561.
No
No
See bug 801561.
No
No
See bug 1457204.
No No
No
See bug 185070.
No
referrer 4.4.3 — 56 33 — 56 37 — 62 ? — 43 No 2.0 — 6.0
report-sample 59 59 ? 43 ? 7.0
report-to 70 70 No No No 10.0
report-uri Yes Yes 23 ? 7 Yes
require-sri-for 54 54 49 — 68
Disabled
49 — 68
Disabled
Disabled From version 49 until version 68 (exclusive): this feature is behind the security.csp.experimentalEnabled preference (needs to be set to true). To change preferences in Firefox, visit about:config.
41 No 6.0
sandbox Yes Yes 50 ? 7 Yes
script-src Yes Yes 23 ? 7 Yes
script-src-attr 75 75 No
No
See bug 1529337.
? No No
script-src-elem 75 75 No
No
See bug 1529337.
? No No
strict-dynamic 52 52 No 41 No 6.0
style-src Yes Yes 23 ? 7 Yes
style-src-attr 75 75 No
No
See bug 1529338.
? No No
style-src-elem 75 75 No
No
See bug 1529338.
? No No
trusted-types 83 83
83
73 — 76
Disabled
Disabled From version 73 until version 76 (exclusive): this feature is behind the #enable-experimental-productivity-features preference (needs to be set to Enabled). To change preferences in Chrome, visit chrome://flags.
No No No No
unsafe-hashes 69 69 No 48 No No
upgrade-insecure-requests 43 43 42 30 10.3 4.0
Worker support Yes Yes 50 ? 10 Yes
worker-src 59
59
Chrome 59 and higher skips the deprecated child-src directive.
59
59
Chrome 59 and higher skips the deprecated child-src directive.
58 45 No 7.0

See also

© 2005–2020 Mozilla and individual contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy