---
title: 'CSP: upgrade-insecure-requests'
slug: Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests
translation_of: Web/HTTP/Headers/Content-Security-Policy/upgrade-insecure-requests
---
<div>{{HTTPSidebar}}</div>

<p> </p>

<p>HTTP {{HTTPHeader("Content-Security-Policy")}} (CSP) <code><strong>upgrade-insecure-requests</strong></code>指令指示客户端将该站点的所有不安全URL（通过HTTP提供的URL）视为已被替换为安全URL（通过HTTPS提供的URL）。该指令适用于需要重写大量不安全的旧版URL的网站。</p>

<p><code>upgrade-insecure-requests</code>指令在 {{CSP("block-all-mixed-content")}} 之前被执行，如果其被设置，后者实际上是空操作。可以设置其中一个，但不能同时设置。</p>

<p>The <code>upgrade-insecure-requests</code> directive will not ensure that users visiting your site via links on third-party sites will be upgraded to HTTPS for the top-level navigation and thus does not replace the {{HTTPHeader("Strict-Transport-Security")}} ({{Glossary("HSTS")}}) header, which should still be set with an appropriate <code>max-age</code> to ensure that users are not subject to SSL stripping attacks.</p>

<h2 id="Syntax">Syntax</h2>

<pre class="syntaxbox">Content-Security-Policy: upgrade-insecure-requests;</pre>

<h2 id="Examples">Examples</h2>

<pre>// header
Content-Security-Policy: upgrade-insecure-requests;

// meta tag
&lt;meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"&gt;
</pre>

<p>一旦将上述头部设置在计划从HTTP迁移到HTTPS的example.com域名上, 非跳转(non-navigational)的不安全资源请求会自动升级到HTTPS（包括第当前域名以及第三方请求）。</p>

<pre class="brush: html">&lt;img src="http://example.com/image.png"&gt;
&lt;img src="http://not-example.com/image.png"&gt;</pre>

<p>这些URL在请求发送之前都会被改写成HTTPS，也就意味着不安全的请求都不会发送出去。注意，如果请求的资源在HTTPS情况下不可用，则该请求将失败, 其也不能回退到HTTP。</p>

<pre class="brush: html">&lt;img src="https://example.com/image.png"&gt;
&lt;img src="https://not-example.com/image.png"&gt;</pre>

<p>Navigational upgrades to third-party resources brings a significantly higher potential for breakage, these are not upgraded:</p>

<pre class="brush: html">&lt;a href="https://example.com/"&gt;Home&lt;/a&gt;
&lt;a href="http://not-example.com/"&gt;Home&lt;/a&gt;</pre>

<h3 id="Finding_insecure_requests">Finding insecure requests</h3>

<p>通过 {{HTTPHeader("Content-Security-Policy-Report-Only")}}  HTTP头部和 {{CSP("report-uri")}} 指令，您可以设置执行策略和报告策略，如下所示：</p>

<pre>Content-Security-Policy: upgrade-insecure-requests; default-src https:
Content-Security-Policy-Report-Only: default-src https:; report-uri /endpoint</pre>

<p>That way, you still upgrade insecure requests on your secure site, but the only monitoring policy is violated and reports insecure resources to your endpoint.</p>

<h2 id="Specifications">Specifications</h2>

<table class="standard-table">
 <tbody>
  <tr>
   <th scope="col">Specification</th>
   <th scope="col">Status</th>
   <th scope="col">Comment</th>
  </tr>
  <tr>
   <td>{{specName("Upgrade Insecure Requests", "#delivery", "upgrade-insecure-requests")}}</td>
   <td>{{Spec2('Upgrade Insecure Requests')}}</td>
   <td>Initial definition.</td>
  </tr>
 </tbody>
</table>

<h2 id="Browser_compatibility">Browser compatibility</h2>

<p>{{Compat("http.headers.csp.upgrade-insecure-requests")}}</p>

<h2 id="See_also">See also</h2>

<ul>
 <li>{{HTTPHeader("Content-Security-Policy")}}</li>
 <li>{{HTTPHeader("Upgrade-Insecure-Requests")}} header</li>
 <li>{{HTTPHeader("Strict-Transport-Security")}} ({{Glossary("HSTS")}}) header</li>
 <li>{{CSP("block-all-mixed-content")}}</li>
 <li><a href="/en-US/docs/Web/Security/Mixed_content">Mixed content</a></li>
</ul>