W3cubDocs

/HTTP

Content-Security-Policy

Content-Security-Policy

The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (Cross-site_scripting).

For more information, see the introductory article on Content Security Policy (CSP).

Header type Response header
Forbidden header name no

Syntax

Content-Security-Policy: <policy-directive>; <policy-directive>

where <policy-directive> consists of: <directive> <value> with no internal punctuation.

Directives

Fetch directives

Fetch directives control the locations from which certain resource types may be loaded.

child-src

Defines the valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>.

Warning: Instead of child-src, if you want to regulate nested browsing contexts and workers, you should use the frame-src and worker-src directives, respectively.

connect-src

Restricts the URLs which can be loaded using script interfaces

default-src

Serves as a fallback for the other fetch directives.

font-src

Specifies valid sources for fonts loaded using @font-face.

frame-src

Specifies valid sources for nested browsing contexts loading using elements such as <frame> and <iframe>.

img-src

Specifies valid sources of images and favicons.

manifest-src

Specifies valid sources of application manifest files.

media-src

Specifies valid sources for loading media using the <audio> , <video> and <track> elements.

object-src

Specifies valid sources for the <object>, <embed>, and <applet> elements.

Note: Elements controlled by object-src are perhaps coincidentally considered legacy HTML elements and are not receiving new standardized features (such as the security attributes sandbox or allow for <iframe>). Therefore it is recommended to restrict this fetch-directive (e.g., explicitly set object-src 'none' if possible).

prefetch-src

Specifies valid sources to be prefetched or prerendered.

script-src

Specifies valid sources for JavaScript and WebAssembly resources.

script-src-elem

Specifies valid sources for JavaScript <script> elements.

script-src-attr

Specifies valid sources for JavaScript inline event handlers.

style-src

Specifies valid sources for stylesheets.

style-src-elem

Specifies valid sources for stylesheets <style> elements and <link> elements with rel="stylesheet".

style-src-attr

Specifies valid sources for inline styles applied to individual DOM elements.

worker-src

Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.

Document directives

Document directives govern the properties of a document or worker environment to which a policy applies.

base-uri

Restricts the URLs which can be used in a document's <base> element.

sandbox

Enables a sandbox for the requested resource similar to the <iframe> sandbox attribute.

Navigation directives govern to which locations a user can navigate or submit a form, for example.

form-action

Restricts the URLs which can be used as the target of a form submissions from a given context.

frame-ancestors

Specifies valid parents that may embed a page using <frame>, <iframe>, <object>, <embed>, or <applet>.

Restricts the URLs to which a document can initiate navigation by any means, including <form> (if form-action is not specified), <a>, window.location, window.open, etc.

Reporting directives

Reporting directives control the reporting process of CSP violations. See also the Content-Security-Policy-Report-Only header.

report-uri

Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

Warning: Though the report-to directive is intended to replace the deprecated report-uri directive, report-to is not supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get report-to support, you can specify both report-uri and report-to: 

Content-Security-Policy: …; report-uri https://endpoint.example.com; report-to groupname

In browsers that support report-to, the report-uri directive will be ignored.

report-to

Fires a SecurityPolicyViolationEvent.

Other directives

require-sri-for

Requires the use of SRI for scripts or styles on the page.

require-trusted-types-for

Enforces Trusted Types at the DOM XSS injection sinks.

trusted-types

Used to specify an allow-list of Trusted Types policies. Trusted Types allows applications to lock down DOM XSS injection sinks to only accept non-spoofable, typed values in place of strings.

upgrade-insecure-requests

Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for websites with large numbers of insecure legacy URLs that need to be rewritten.

Deprecated directives

block-all-mixed-content

Prevents loading any assets using HTTP when the page is loaded using HTTPS.

plugin-types

Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.

referrer

Used to specify information in the Referer (sic) header for links away from a page. Use the Referrer-Policy header instead.

Values

An overview of the allowed values are listed below. For detailed reference see CSP Source Values and the documentation for individual directives.

Keyword values

none

Won't allow loading of any resources.

self

Only allow resources from the current origin.

strict-dynamic

The trust granted to a script in the page due to an accompanying nonce or hash is extended to the scripts it loads.

report-sample

Require a sample of the violating code to be included in the violation report.

Unsafe keyword values

unsafe-inline

Allow use of inline resources.

unsafe-eval

Allow use of dynamic code evaluation such as eval, setImmediate , and window.execScript .

unsafe-hashes

Allows enabling specific inline event handlers.

unsafe-allow-redirects

TBD

Hosts values

  • Host
    • Only allow loading of resources from a specific host, with optional scheme, port, and path. e.g. example.com, *.example.com, https://*.example.com:12/path/to/file.js
    • Path parts in the CSP that end in / match any path they are a prefix of. e.g. example.com/api/ will match URLs like example.com/api/users/new.
    • Other path parts in the CSP are matched exactly e.g. example.com/file.js will match http://example.com/file.js and https://example.com/file.js, but not https://example.com/file.js/file2.js
  • Scheme
    • Only allow loading of resources over a specific scheme, should always end with ":". e.g. https:, http:, data: etc.

Other values

nonce-*

A cryptographic nonce (only used once) to allow scripts. The server must generate a unique nonce value each time it transmits a policy. It is critical to provide a nonce that cannot be guessed as bypassing a resource's policy is otherwise trivial. This is used in conjunction with the script tag nonce attribute. e.g. nonce-DhcnhD3khTMePgXwdayK9BsMqXjhguVV

sha*-*

sha256, sha384, or sha512. followed by a dash and then the sha* value. e.g. sha256-jzgBGA4UWFFmpOBq0JpdsySukE1FrEN5bUpoK8Z29fY=

CSP in workers

Workers are in general not governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a Content-Security-Policy response header for the request which requested the worker script itself.

The exception to this is if the worker script's origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker that created it.

Multiple content security policies

The CSP mechanism allows multiple policies being specified for a resource, including via the Content-Security-Policy header, the Content-Security-Policy-Report-Only header and a <meta> element.

You can use the Content-Security-Policy header more than once, as in the example below. Pay special attention to the connect-src directive here. Even though the second policy would allow the connection, the first policy contains connect-src 'none'. Adding additional policies can only further restrict the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, connect-src 'none' is enforced. 

Content-Security-Policy: default-src 'self' http://example.com;
                          connect-src 'none';
Content-Security-Policy: connect-src http://example.com/;
                          script-src http://example.com/

Examples

Example: Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https:

Using the HTTP header

Content-Security-Policy: default-src https:

Using the HTML meta element

<meta http-equiv="Content-Security-Policy" content="default-src https:" />

Example: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over HTTPS and to disable plugins: 

Content-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'

Example: Do not implement the above policy yet; instead just report violations that would have occurred: 

Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

See Mozilla Web Security Guidelines for more examples.

Specifications

Specification
Content Security Policy Level 3
# csp-header

Browser compatibility

Desktop Mobile
Chrome Edge Firefox Internet Explorer Opera Safari WebView Android Chrome Android Firefox for Android Opera Android Safari on IOS Samsung Internet
Content-Security-Policy
25
14
14
23
4
10
Only supporting 'sandbox' directive.
15
7
6
Yes
Yes
23
Yes
7
6
Yes
base-uri
40
79
35
No
27
10
Yes
Yes
35
No
9.3
Yes
block-all-mixed-content
Yes
≤79
48
No
Yes
No
Yes
Yes
48
No
No
Yes
child-src
40
15
45
No
27
10
Yes
Yes
45
No
9.3
Yes
connect-src
25
14
23
Before Firefox 50, ping attributes of <a> elements weren't covered by connect-src.
No
15
7
Yes
Yes
23
No
7
Yes
default-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
font-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
form-action
40
15
36
No
27
10
Yes
Yes
36
No
9.3
Yes
frame-ancestors
40
15
33
Before Firefox 58, frame-ancestors is ignored in Content-Security-Policy-Report-Only.
No
26
10
No
Yes
33
Before Firefox for Android 58, frame-ancestors is ignored in Content-Security-Policy-Report-Only.
No
9.3
Yes
frame-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
img-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
manifest-src
Yes
79
41
No
Yes
No
Yes
Yes
41
No
No
Yes
media-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
meta-element-support
Yes
≤18
45
No
Yes
Yes
Yes
Yes
45
Yes
Yes
Yes
navigate-to
No
No
No
No
No
No
No
No
No
No
No
No
object-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
plugin-types
40-90
15-90
No
No
27-76
10
Yes-90
Yes-90
No
No
9.3
Yes-15.0
prefetch-src
No
No
No
No
No
No
No
No
No
No
No
No
referrer
33-56
No
37-62
No
Yes-43
No
4.4.3-56
33-56
37-62
Yes-43
No
2.0-6.0
report-sample
59
≤79
No
No
46
15.4
59
59
No
43
15.4
7.0
report-to
70
79
No
No
No
No
70
70
No
No
No
10.0
report-uri
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
require-sri-for
54
79
No
No
41
No
54
54
No
41
No
6.0
require-trusted-types-for
83
83
No
No
69
No
83
83
No
59
No
13.0
sandbox
25
14
50
10
15
7
Yes
Yes
50
No
7
Yes
script-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
script-src-attr
75
79
No
No
62
preview
75
75
No
No
No
11.0
script-src-elem
75
79
No
No
62
preview
75
75
No
No
No
11.0
strict-dynamic
52
79
52
No
39
15.4
52
52
No
41
15.4
6.0
style-src
25
14
23
No
15
7
Yes
Yes
23
No
7
Yes
style-src-attr
75
79
No
No
62
preview
75
75
No
No
No
11.0
style-src-elem
75
79
No
No
62
preview
75
75
No
No
No
11.0
trusted-types
83
83
No
No
69
No
83
83
No
No
No
13.0
unsafe-hashes
69
79
No
No
56
15.4
69
69
No
48
15.4
10.0
upgrade-insecure-requests
43
17
42
No
30
10.1
43
43
42
30
10.3
4.0
worker-src
59
Chrome 59 and higher skips the deprecated child-src directive.
79
58
No
48
15.5
59
Chrome 59 and higher skips the deprecated child-src directive.
59
Chrome 59 and higher skips the deprecated child-src directive.
58
45
15.5
7.0
worker_support
Yes
≤79
50
No
No
10
Yes
Yes
50
No
10
Yes

See also

© 2005–2022 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy