The HTTP Content-Security-Policy
response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (XSS).
For more information, see the introductory article on Content Security Policy (CSP).
Header type | Response header |
---|---|
Forbidden header name | no |
Syntax
Content-Security-Policy: <policy-directive>; <policy-directive>
where <policy-directive>
consists of: <directive> <value>
with no internal punctuation.
Directives
Fetch directives
Fetch directives control the locations from which certain resource types may be loaded.
child-src
-
Defines the valid sources for web workers and nested browsing contexts loaded using elements such as
<frame>
and<iframe>
.Instead of
child-src
, if you want to regulate nested browsing contexts and workers, you should use theframe-src
andworker-src
directives, respectively. connect-src
- Restricts the URLs which can be loaded using script interfaces
default-src
- Serves as a fallback for the other fetch directives.
font-src
- Specifies valid sources for fonts loaded using
@font-face
. frame-src
- Specifies valid sources for nested browsing contexts loading using elements such as
<frame>
and<iframe>
. img-src
- Specifies valid sources of images and favicons.
manifest-src
- Specifies valid sources of application manifest files.
media-src
- Specifies valid sources for loading media using the
<audio>
,<video>
and<track>
elements. object-src
- Specifies valid sources for the
<object>
,<embed>
, and<applet>
elements. - Elements controlled by
object-src
are perhaps coincidentally considered legacy HTML elements and are not receiving new standardized features (such as the security attributessandbox
orallow
for<iframe>
). Therefore it is recommended to restrict this fetch-directive (e.g., explicitly setobject-src 'none'
if possible). prefetch-src
- Specifies valid sources to be prefetched or prerendered.
script-src
- Specifies valid sources for JavaScript.
script-src-elem
- Specifies valid sources for JavaScript
<script>
elements. script-src-attr
- Specifies valid sources for JavaScript inline event handlers.
style-src
- Specifies valid sources for stylesheets.
style-src-elem
- Specifies valid sources for stylesheets
<style>
elements and<link>
elements withrel="stylesheet"
. style-src-attr
- Specifies valid sources for inline styles applied to individual DOM elements.
worker-src
- Specifies valid sources for
Worker
,SharedWorker
, orServiceWorker
scripts.
Document directives
Document directives govern the properties of a document or worker environment to which a policy applies.
base-uri
- Restricts the URLs which can be used in a document's
<base>
element. plugin-types
- Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.
sandbox
- Enables a sandbox for the requested resource similar to the
<iframe>
sandbox
attribute.
Navigation directives
Navigation directives govern to which locations a user can navigate or submit a form, for example.
form-action
- Restricts the URLs which can be used as the target of a form submissions from a given context.
frame-ancestors
- Specifies valid parents that may embed a page using
<frame>
,<iframe>
,<object>
,<embed>
, or<applet>
. navigate-to
- Restricts the URLs to which a document can initiate navigation by any means, including
<form>
(ifform-action
is not specified),<a>
,window.location
,window.open
, etc.
Reporting directives
Reporting directives control the reporting process of CSP violations. See also the Content-Security-Policy-Report-Only
header.
report-uri
- Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of JSON documents sent via an HTTP
POST
request to the specified URI.Though the
report-to
directive is intended to replace the deprecatedreport-uri
directive,report-to
is not supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers getreport-to
support, you can specify bothreport-uri
andreport-to
:Content-Security-Policy: ...; report-uri https://endpoint.example.com; report-to groupname
In browsers that support
report-to
, thereport-uri
directive will be ignored. report-to
- Fires a
SecurityPolicyViolationEvent
.
Other directives
block-all-mixed-content
- Prevents loading any assets using HTTP when the page is loaded using HTTPS.
referrer
- Used to specify information in the Referer (sic) header for links away from a page. Use the
Referrer-Policy
header instead. require-sri-for
- Requires the use of SRI for scripts or styles on the page.
require-trusted-types-for
- Enforces Trusted Types at the DOM XSS injection sinks.
trusted-types
- Used to specify an allow-list of Trusted Types policies. Trusted Types allows applications to lock down DOM XSS injection sinks to only accept non-spoofable, typed values in place of strings.
upgrade-insecure-requests
- Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.
CSP in workers
Workers are in general not governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a Content-Security-Policy
response header for the request which requested the worker script itself.
The exception to this is if the worker script's origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker that created it.
Multiple content security policies
The CSP mechanism allows multiple policies being specified for a resource, including via the Content-Security-Policy
header, the Content-Security-Policy-Report-Only
header and a <meta>
element.
You can use the Content-Security-Policy
header more than once, as in the example below. Pay special attention to the connect-src
directive here. Even though the second policy would allow the connection, the first policy contains connect-src 'none'
. Adding additional policies can only further restrict the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, connect-src 'none'
is enforced.
Content-Security-Policy: default-src 'self' http://example.com; connect-src 'none'; Content-Security-Policy: connect-src http://example.com/; script-src http://example.com/
Examples
Example: Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https:
// header Content-Security-Policy: default-src https: // meta tag <meta http-equiv="Content-Security-Policy" content="default-src https:">
Example: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over HTTPS and to disable plugins:
Content-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'
Example: Do not implement the above policy yet; instead just report violations that would have occurred:
Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/
See Mozilla Web Security Guidelines for more examples.
Specifications
Specification | Status | Comment |
---|---|---|
Content Security Policy Level 3 | Working Draft | Adds manifest-src , navigate-to , report-to , strict-dynamic , worker-src . Undeprecates frame-src . Deprecates report-uri in favor if report-to . |
Mixed Content | Candidate Recommendation | Adds block-all-mixed-content . |
Subresource Integrity | Recommendation | Adds require-sri-for . |
Upgrade Insecure Requests | Candidate Recommendation | Adds upgrade-insecure-requests . |
Content Security Policy Level 2 | Recommendation | Adds base-uri , child-src , form-action , frame-ancestors , plugin-types , referrer , and report-uri . Deprecates frame-src . |
Content Security Policy 1.0 | Obsolete | Defines connect-src , default-src , font-src , frame-src , img-src , media-src , object-src , report-uri, sandbox , script-src, and style-src . |
Browser compatibility
The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Desktop | Mobile | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|
Content-Security-Policy | Chrome
Full support
25
| Edge Full support 14 | Firefox
Full support
23
| IE
Full support
10
| Opera Full support 15 | Safari
Full support
7
| WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android Full support Yes | Safari iOS
Full support
7
| Samsung Internet Android Full support Yes |
base-uri | Chrome Full support 40 | Edge Full support 79 | Firefox Full support 35 | IE No support No | Opera Full support 27 | Safari Full support 10 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 35 | Opera Android ? | Safari iOS Full support 9.3 | Samsung Internet Android Full support Yes |
block-all-mixed-content | Chrome Full support Yes | Edge Full support ≤79 | Firefox Full support 48 | IE No support No | Opera Full support Yes | Safari ? | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 48 | Opera Android ? | Safari iOS ? | Samsung Internet Android Full support Yes |
child-src | Chrome Full support 40 | Edge Full support 15 | Firefox Full support 45 | IE No support No | Opera Full support 27 | Safari Full support 10 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 45 | Opera Android ? | Safari iOS Full support 9.3 | Samsung Internet Android Full support Yes |
connect-src | Chrome Full support 25 | Edge Full support 14 | Firefox
Full support
23
| IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
default-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
font-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
form-action | Chrome Full support 40 | Edge Full support 15 | Firefox Full support 36 | IE No support No | Opera Full support 27 | Safari Full support 10 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 36 | Opera Android ? | Safari iOS Full support 9.3 | Samsung Internet Android Full support Yes |
frame-ancestors | Chrome Full support 40 | Edge Full support 15 | Firefox
Full support
33
| IE No support No | Opera Full support 26 | Safari Full support 10 | WebView Android ? | Chrome Android Full support Yes | Firefox Android
Full support
33
| Opera Android ? | Safari iOS Full support 9.3 | Samsung Internet Android Full support Yes |
frame-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
img-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
manifest-src | Chrome Full support Yes | Edge Full support 79 | Firefox Full support 41 | IE No support No | Opera Full support Yes | Safari No support No | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 41 | Opera Android ? | Safari iOS No support No | Samsung Internet Android Full support Yes |
media-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
<meta> element support | Chrome Full support Yes | Edge Full support ≤18 | Firefox Full support 45 | IE No support No | Opera Full support Yes | Safari Full support Yes | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 45 | Opera Android Full support Yes | Safari iOS Full support Yes | Samsung Internet Android Full support Yes |
navigate-to | Chrome No support No | Edge No support No | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android No support No | Chrome Android No support No | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
object-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
plugin-types | Chrome Full support 40 | Edge Full support 15 | Firefox
No support
No
| IE No support No | Opera Full support 27 | Safari Full support 10 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android No support No | Opera Android ? | Safari iOS Full support 9.3 | Samsung Internet Android Full support Yes |
prefetch-src | Chrome
No support
No
| Edge
No support
No
| Firefox
No support
No
| IE No support No | Opera No support No | Safari
No support
No
| WebView Android
No support
No
| Chrome Android
No support
No
| Firefox Android
No support
No
| Opera Android No support No | Safari iOS
No support
No
| Samsung Internet Android No support No |
referrer | Chrome No support 33 — 56 | Edge No support No | Firefox No support 37 — 62 | IE No support No | Opera No support ? — 43 | Safari No support No | WebView Android No support 4.4.3 — 56 | Chrome Android No support 33 — 56 | Firefox Android No support 37 — 62 | Opera Android No support ? — 43 | Safari iOS No support No | Samsung Internet Android No support 2.0 — 6.0 |
report-sample | Chrome Full support 59 | Edge Full support ≤79 | Firefox ? | IE ? | Opera Full support 46 | Safari ? | WebView Android Full support 59 | Chrome Android Full support 59 | Firefox Android ? | Opera Android Full support 43 | Safari iOS ? | Samsung Internet Android Full support 7.0 |
report-to | Chrome Full support 70 | Edge Full support 79 | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android Full support 70 | Chrome Android Full support 70 | Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android Full support 10.0 |
report-uri | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
require-sri-for | Chrome Full support 54 | Edge Full support 79 | Firefox
No support
49 — 68
| IE No support No | Opera Full support 41 | Safari No support No | WebView Android Full support 54 | Chrome Android Full support 54 | Firefox Android
No support
49 — 68
| Opera Android Full support 41 | Safari iOS No support No | Samsung Internet Android Full support 6.0 |
sandbox | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 50 | IE Full support 10 | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 50 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
script-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
script-src-attr | Chrome Full support 75 | Edge Full support 79 | Firefox
No support
No
| IE No support No | Opera Full support 62 | Safari No support No | WebView Android Full support 75 | Chrome Android Full support 75 | Firefox Android
No support
No
| Opera Android ? | Safari iOS No support No | Samsung Internet Android No support No |
script-src-elem | Chrome Full support 75 | Edge Full support 79 | Firefox
No support
No
| IE No support No | Opera Full support 62 | Safari No support No | WebView Android Full support 75 | Chrome Android Full support 75 | Firefox Android
No support
No
| Opera Android ? | Safari iOS No support No | Samsung Internet Android No support No |
strict-dynamic | Chrome Full support 52 | Edge Full support 79 | Firefox Full support 52 | IE No support No | Opera Full support 39 | Safari No support No | WebView Android Full support 52 | Chrome Android Full support 52 | Firefox Android No support No | Opera Android Full support 41 | Safari iOS No support No | Samsung Internet Android Full support 6.0 |
style-src | Chrome Full support 25 | Edge Full support 14 | Firefox Full support 23 | IE No support No | Opera Full support 15 | Safari Full support 7 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 23 | Opera Android ? | Safari iOS Full support 7 | Samsung Internet Android Full support Yes |
style-src-attr | Chrome Full support 75 | Edge Full support 79 | Firefox
No support
No
| IE No support No | Opera Full support 62 | Safari No support No | WebView Android Full support 75 | Chrome Android Full support 75 | Firefox Android
No support
No
| Opera Android ? | Safari iOS No support No | Samsung Internet Android No support No |
style-src-elem | Chrome Full support 75 | Edge Full support 79 | Firefox
No support
No
| IE No support No | Opera Full support 62 | Safari No support No | WebView Android Full support 75 | Chrome Android Full support 75 | Firefox Android
No support
No
| Opera Android ? | Safari iOS No support No | Samsung Internet Android No support No |
trusted-types | Chrome
Full support
83
| Edge ? | Firefox No support No | IE No support No | Opera No support No | Safari No support No | WebView Android Full support 83 | Chrome Android
Full support
83
| Firefox Android No support No | Opera Android No support No | Safari iOS No support No | Samsung Internet Android No support No |
unsafe-hashes | Chrome Full support 69 | Edge Full support 79 | Firefox
No support
No
| IE No support No | Opera Full support 56 | Safari No support No | WebView Android Full support 69 | Chrome Android Full support 69 | Firefox Android No support No | Opera Android Full support 48 | Safari iOS No support No | Samsung Internet Android No support No |
upgrade-insecure-requests | Chrome Full support 43 | Edge Full support 17 | Firefox Full support 42 | IE No support No | Opera Full support 30 | Safari Full support 10.1 | WebView Android Full support 43 | Chrome Android Full support 43 | Firefox Android Full support 42 | Opera Android Full support 30 | Safari iOS Full support 10.3 | Samsung Internet Android Full support 4.0 |
Worker support | Chrome Full support Yes | Edge Full support ≤79 | Firefox Full support 50 | IE No support No | Opera ? | Safari Full support 10 | WebView Android Full support Yes | Chrome Android Full support Yes | Firefox Android Full support 50 | Opera Android ? | Safari iOS Full support 10 | Samsung Internet Android Full support Yes |
worker-src | Chrome
Full support
59
| Edge Full support 79 | Firefox Full support 58 | IE No support No | Opera Full support 48 | Safari No support No | WebView Android
Full support
59
| Chrome Android
Full support
59
| Firefox Android Full support 58 | Opera Android Full support 45 | Safari iOS No support No | Samsung Internet Android Full support 7.0 |
Legend
- Full support
- Full support
- No support
- No support
- Compatibility unknown
- Compatibility unknown
- Experimental. Expect behavior to change in the future.
- Experimental. Expect behavior to change in the future.
- Non-standard. Expect poor cross-browser support.
- Non-standard. Expect poor cross-browser support.
- Deprecated. Not for use in new websites.
- Deprecated. Not for use in new websites.
- See implementation notes.
- See implementation notes.
- User must explicitly enable this feature.
- User must explicitly enable this feature.
- Uses a non-standard name.
- Uses a non-standard name.
See also
Content-Security-Policy-Report-Only
- Learn about: Content Security Policy
- Content Security in WebExtensions
- Adopting a strict policy
- CSP Evaluator - Evaluate your Content Security Policy