Select Page

The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).

For more information, see also this article on Content Security Policy (CSP).

Syntax

Content-Security-Policy: <policy-directive>; <policy-directive>

Directives

Fetch directives

Fetch directives control locations from which certain resource types may be loaded.

and <iframe>. For workers, non-compliant requests are treated as fatal network errors by the user agent.”>child-src
Defines the valid sources for web workers and nested browsing contexts loaded using elements such as is an HTML element which defines a particular area in which another HTML document can be displayed. A frame should be used within a <frameset>.”><frame> and ) represents a nested browsing context, embedding another HTML page into the current one.”><iframe>.

Instead of child-src, authors who wish to regulate nested browsing contexts and workers should use the and <iframe>.”>frame-src and worker-src directives, respectively.

connect-src
Restricts the URLs which can be loaded using script interfaces
default-src
Serves as a fallback for the other fetch directives.
font-src
Specifies valid sources for fonts loaded using @font-face.
and <iframe>.”>frame-src
Specifies valid sources for nested browsing contexts loading using elements such as is an HTML element which defines a particular area in which another HTML document can be displayed. A frame should be used within a <frameset>.”><frame> and ) represents a nested browsing context, embedding another HTML page into the current one.”><iframe>.
img-src
Specifies valid sources of images and favicons.
manifest-src
Specifies valid sources of application manifest files.
and <video> elements.”>media-src
Specifies valid sources for loading media using the element is used to embed sound content in documents. It may contain one or more audio sources, represented using the src attribute or the <source> element: the browser will choose the most suitable one. It can also be the destination for streamed media, using a MediaStream.”><audio> , ) embeds a media player which supports video playback into the document.”><video> and element is used as a child of the media elements <audio> and <video>. It lets you specify timed text tracks (or time-based data), for example to automatically handle subtitles. The tracks are formatted in WebVTT format (.vtt files) — Web Video Text Tracks or Timed Text Markup Language (TTML).”><track> elements.
, <embed>, and <applet> elements.”>object-src
Specifies valid sources for the element represents an external resource, which can be treated as an image, a nested browsing context, or a resource to be handled by a plugin.”><object>, element embeds external content at the specified point in the document. This content is provided by an external application or other source of interactive content such as a browser plug-in.”><embed>, and ) embeds a Java applet into the document; this element has been deprecated in favor of <object>.”><applet> elements.
prefetch-src
Specifies valid sources to be prefetched or prerendered.
elements, but also things like inline script event handlers (onclick) and XSLT stylesheets which can trigger script execution.”>script-src
Specifies valid sources for JavaScript.
style-src
Specifies valid sources for stylesheets.
webrtc-src
Specifies valid sources for WebRTC connections.
worker-src
Specifies valid sources for Worker, SharedWorker, or ServiceWorker scripts.

Document directives

Document directives govern the properties of a document or worker environment to which a policy applies.

element. If this value is absent, then any URI is allowed. If this directive is absent, the user agent will use the value in the <base> element.”>base-uri
Restricts the URLs which can be used in a document’s element specifies the base URL to use for all relative URLs contained within a document. There can be only one <base> element in a document.”><base> element.
plugin-types
Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.
sandbox attribute. It applies restrictions to a page’s actions including preventing popups, preventing the execution of plugins and scripts, and enforcing a same-origin policy.”>sandbox
Enables a sandbox for the requested resource similar to the ) represents a nested browsing context, embedding another HTML page into the current one.”><iframe> sandbox attribute.
disown-opener
Ensures a resource will disown its opener when navigated to.

Navigation directives

Navigation directives govern to which location a user can navigate to or submit a form to, for example.

form-action
Restricts the URLs which can be used as the target of a form submissions from a given context.
, <iframe>, <object>, <embed>, or <applet>.”>frame-ancestors
Specifies valid parents that may embed a page using is an HTML element which defines a particular area in which another HTML document can be displayed. A frame should be used within a <frameset>.”><frame>, ) represents a nested browsing context, embedding another HTML page into the current one.”><iframe>, element represents an external resource, which can be treated as an image, a nested browsing context, or a resource to be handled by a plugin.”><object>, element embeds external content at the specified point in the document. This content is provided by an external application or other source of interactive content such as a browser plug-in.”><embed>, or ) embeds a Java applet into the document; this element has been deprecated in favor of <object>.”><applet>.
navigate-to
Restricts the URLs to which a document can navigate by any means (a, form, window.location, window.open, etc.)

Reporting directives

Reporting directives control the reporting process of CSP violations. See also the Content-Security-Policy-Report-Only header.

report-uri
Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP POST request to the specified URI.

Though the report-to directive is intended to replace the deprecated report-uri directive, report-to isn’t supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get report-to support, you can specify both report-uri and report-to:

Content-Security-Policy: …; report-uri https://endpoint.example.com; report-to groupname

In browsers that support report-to, the report-uri directive will be ignored.

report-to
Fires a SecurityPolicyViolationEvent.

Other directives

block-all-mixed-content
Prevents loading any assets using HTTP when the page is loaded using HTTPS.
referrer
Used to specify information in the referer (sic) header for links away from a page. Use the Referrer-Policy header instead.
require-sri-for
Requires the use of SRI for scripts or styles on the page.
upgrade-insecure-requests
Instructs user agents to treat all of a site’s insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.

CSP in workers

Workers are in general not governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a Content-Security-Policy response header for the request which requested the worker script itself.

The exception to this is if the worker script’s origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker that created it.

Multiple content security policies

CSP allows multiple policies being specified for a resource, including via the Content-Security-Policy header, the Content-Security-Policy-Report-Only header and a element represents metadata that cannot be represented by other HTML meta-related elements, like <base>, <link>, <script>, <style> or <title>.”><meta> element.

You can use the Content-Security-Policy header more than once like in the example below. Pay special attention to the connect-src directive here. Even though the second policy would allow the connection, the first policy contains connect-src ‘none’. Adding additional policies can only further restrict the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, connect-src ‘none’ is enforced.

Content-Security-Policy: default-src ‘self’ http://example.com;
connect-src ‘none’;
Content-Security-Policy: connect-src http://example.com/;
script-src http://example.com/

Examples

Example: Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https:

// header
Content-Security-Policy: default-src https:

// meta tag
<meta http-equiv=”Content-Security-Policy” content=”default-src https:”>

Example: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over https and disable plugins:

Content-Security-Policy: default-src https: ‘unsafe-eval’ ‘unsafe-inline’; object-src ‘none’

Example: Don’t implement the above policy yet; instead just report violations that would have occurred:

Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/

See Mozilla Web Security Guidelines for more examples.

Specifications

Specification Status Comment
Content Security Policy Level 3 Working Draft Adds disown-opener, manifest-src, navigate-to, report-to, strict-dynamic, worker-src. Undeprecates frame-src. Deprecates report-uri in favor if report-to.
Mixed Content Candidate Recommendation Adds block-all-mixed-content.
Subresource Integrity Recommendation Adds require-sri-for.
Upgrade Insecure Requests Candidate Recommendation Adds upgrade-insecure-requests.
Content Security Policy Level 2 Recommendation Adds base-uri, child-src, form-action, frame-ancestors, plugin-types, referrer, and report-uri. Deprecates frame-src.
Content Security Policy 1.0 Obsolete Defines connect-src, default-src, font-src, frame-src, img-src, media-src, object-src, report-uri, sandbox, script-src, and style-src.

Browser compatibility

The compatibility table in this page is generated from structured data. If you’d like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.

Update compatibility data on GitHub

Desktop Mobile
Chrome Edge Firefox Internet Explorer Opera Safari Android webview Chrome for Android Edge Mobile Firefox for Android Opera for Android Safari on iOS Samsung Internet
Content-Security-Policy Chrome
Full support

25
Full support

25
Full support

14

X-Webkit-CSP</code>”>Alternate Name

X-Webkit-CSP</code>”>Alternate Name Uses the non-standard name: X-Webkit-CSP

Edge
Full support

14

Firefox
Full support

23
Full support

23
Full support

4

X-Content-Security-Policy</code>”>Alternate Name

X-Content-Security-Policy</code>”>Alternate Name Uses the non-standard name: X-Content-Security-Policy

IE
Full support

10

Notes X-Content-Security-Policy</code>”>Alternate Name

Full support

10

Notes X-Content-Security-Policy</code>”>Alternate Name

Notes Only supporting ‘sandbox’ directive.X-Content-Security-Policy</code>”>Alternate Name Uses the non-standard name: X-Content-Security-Policy

Opera
Full support

15

Safari
Full support

7
Full support

7
Full support

6

X-Webkit-CSP</code>”>Alternate Name

X-Webkit-CSP</code>”>Alternate Name Uses the non-standard name: X-Webkit-CSP

WebView Android
Full support

Yes

Chrome Android
Full support

Yes

Edge Mobile
Full support

Yes

Firefox Android
Full support

23

Opera Android
?
Safari iOS
Full support

7.1
Full support

7.1
Full support

5.1

Notes

Notes X-Webkit-CSP

Samsung Internet Android
Full support

Yes

<meta> element support Chrome
Full support

Yes

Edge
Full support

Yes

Firefox
Full support

45

IE
No support

No

Opera
Full support

Yes

Safari
Full support

Yes

WebView Android
Full support

Yes

Chrome Android
Full support

Yes

Edge Mobile
Full support

Yes

Firefox Android
Full support

45

Opera Android
Full support

Yes

Safari iOS
Full support

Yes

Samsung Internet Android
Full support

Yes

Worker support Chrome
Full support

Yes

Edge
?
Firefox
Full support

50

IE
No support

No

Opera
?
Safari
No support

No

WebView Android
Full support

Yes

Chrome Android
Full support

Yes

Edge Mobile
?
Firefox Android
Full support

50

Opera Android
?
Safari iOS
No support

No

Samsung Internet Android
Full support

Yes

Legend

Full support

Full support

No support

No support

Compatibility unknown

Compatibility unknownSee implementation notes.See implementation notes.Uses a non-standard name.Uses a non-standard name.

See also

Source