path: root/files/vi/web/http/headers/content-security-policy/index.html

---
title: Content-Security-Policy
slug: Web/HTTP/Headers/Content-Security-Policy
tags:
  - CSP
  - Content Security Policy
  - HTTP
  - NeedsTranslation
  - Reference
  - Security
  - TopicStub
  - header
translation_of: Web/HTTP/Headers/Content-Security-Policy
---
<div>{{HTTPSidebar}}</div>

<p>The HTTP <strong><code>Content-Security-Policy</code></strong> response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks ({{Glossary("XSS")}}).</p>

<p>For more information, see the introductory article on <a href="/en-US/docs/Web/HTTP/CSP">Content Security Policy (CSP)</a>.</p>

<table class="properties">
 <tbody>
  <tr>
   <th scope="row">Header type</th>
   <td>{{Glossary("Response header")}}</td>
  </tr>
  <tr>
   <th scope="row">{{Glossary("Forbidden header name")}}</th>
   <td>no</td>
  </tr>
 </tbody>
</table>

<h2 id="Syntax">Syntax</h2>

<pre class="syntaxbox notranslate">Content-Security-Policy: &lt;policy-directive&gt;; &lt;policy-directive&gt;
</pre>

<p>where <code>&lt;policy-directive&gt;</code> consists of: <code>&lt;directive&gt; &lt;value&gt;</code> with no internal punctuation.</p>

<h2 id="Directives">Directives</h2>

<h3 id="Fetch_directives" name="Fetch_directives">Fetch directives</h3>

<p>Fetch directives control the locations from which certain resource types may be loaded.</p>

<dl>
 <dt>{{CSP("child-src")}}</dt>
 <dd>
 <p>Defines the valid sources for <a href="/en-US/docs/Web/API/Web_Workers_API">web workers</a> and nested browsing contexts loaded using elements such as {{HTMLElement("frame")}} and {{HTMLElement("iframe")}}.</p>

 <div class="warning">
 <p>Instead of <strong><code>child-src</code></strong>, if you want to regulate nested browsing contexts and workers, you should use the {{CSP("frame-src")}} and {{CSP("worker-src")}} directives, respectively.</p>
 </div>
 </dd>
 <dt>{{CSP("connect-src")}}</dt>
 <dd>Restricts the URLs which can be loaded using script interfaces</dd>
 <dt>{{CSP("default-src")}}</dt>
 <dd>Serves as a fallback for the other {{Glossary("Fetch directive", "fetch directives")}}.</dd>
 <dt>{{CSP("font-src")}}</dt>
 <dd>Specifies valid sources for fonts loaded using {{cssxref("@font-face")}}.</dd>
 <dt>{{CSP("frame-src")}}</dt>
 <dd>Specifies valid sources for nested browsing contexts loading using elements such as {{HTMLElement("frame")}} and {{HTMLElement("iframe")}}.</dd>
 <dt>{{CSP("img-src")}}</dt>
 <dd>Specifies valid sources of images and favicons.</dd>
 <dt>{{CSP("manifest-src")}}</dt>
 <dd>Specifies valid sources of application manifest files.</dd>
 <dt>{{CSP("media-src")}}</dt>
 <dd>Specifies valid sources for loading media using the {{HTMLElement("audio")}} , {{HTMLElement("video")}} and {{HTMLElement("track")}} elements.</dd>
 <dt>{{CSP("object-src")}}</dt>
 <dd>Specifies valid sources for the {{HTMLElement("object")}}, {{HTMLElement("embed")}}, and {{HTMLElement("applet")}} elements.</dd>
 <dd class="note">Elements controlled by <code>object-src</code> are perhaps coincidentally considered legacy HTML elements and are not receiving new standardized features (such as the security attributes <code>sandbox</code> or <code>allow</code> for <code>&lt;iframe&gt;</code>). Therefore it is <strong>recommended</strong> to restrict this fetch-directive (e.g., explicitly set <code>object-src 'none'</code> if possible).</dd>
 <dt>{{CSP("prefetch-src")}}{{experimental_inline}}</dt>
 <dd>Specifies valid sources to be prefetched or prerendered.</dd>
 <dt>{{CSP("script-src")}}</dt>
 <dd>Specifies valid sources for JavaScript.</dd>
 <dt>{{CSP("script-src-elem")}}{{experimental_inline}}</dt>
 <dd>Specifies valid sources for JavaScript {{HTMLElement("script")}} elements.</dd>
 <dt>{{CSP("script-src-attr")}}{{experimental_inline}}</dt>
 <dd>Specifies valid sources for JavaScript inline event handlers.</dd>
</dl>

<dl>
 <dt>{{CSP("style-src")}}</dt>
 <dd>Specifies valid sources for stylesheets.</dd>
 <dt>{{CSP("style-src-elem")}}{{experimental_inline}}</dt>
 <dd>Specifies valid sources for stylesheets {{HTMLElement("style")}} elements and {{HTMLElement("link")}} elements with <code>rel="stylesheet"</code>.</dd>
 <dt>{{CSP("style-src-attr")}}{{experimental_inline}}</dt>
 <dd>Specifies valid sources for inline styles applied to individual DOM elements.</dd>
 <dt>{{CSP("worker-src")}}{{experimental_inline}}</dt>
 <dd>Specifies valid sources for {{domxref("Worker")}}, {{domxref("SharedWorker")}}, or {{domxref("ServiceWorker")}} scripts.</dd>
</dl>

<h3 id="Document_directives" name="Document_directives">Document directives</h3>

<p>Document directives govern the properties of a document or <a href="/en-US/docs/Web/API/Web_Workers_API">worker</a> environment to which a policy applies.</p>

<dl>
 <dt>{{CSP("base-uri")}}</dt>
 <dd>Restricts the URLs which can be used in a document's {{HTMLElement("base")}} element.</dd>
 <dt>{{CSP("plugin-types")}}</dt>
 <dd>Restricts the set of plugins that can be embedded into a document by limiting the types of resources which can be loaded.</dd>
 <dt>{{CSP("sandbox")}}</dt>
 <dd>Enables a sandbox for the requested resource similar to the {{HTMLElement("iframe")}} {{htmlattrxref("sandbox", "iframe")}} attribute.</dd>
</dl>

<h3 id="Navigation_directives" name="Navigation_directives">Navigation directives</h3>

<p>Navigation directives govern to which locations a user can navigate or submit a form, for example.</p>

<dl>
 <dt>{{CSP("form-action")}}</dt>
 <dd>Restricts the URLs which can be used as the target of a form submissions from a given context.</dd>
 <dt>{{CSP("frame-ancestors")}}</dt>
 <dd>Specifies valid parents that may embed a page using {{HTMLElement("frame")}}, {{HTMLElement("iframe")}}, {{HTMLElement("object")}}, {{HTMLElement("embed")}}, or {{HTMLElement("applet")}}.</dd>
 <dt>{{CSP("navigate-to")}}{{experimental_inline}}</dt>
 <dd>Restricts the URLs to which a document can initiate navigation by any means, including {{HTMLElement("form")}} (if {{CSP("form-action")}} is not specified), {{HTMLElement("a")}}, {{DOMxRef("window.location")}}, {{DOMxRef("window.open")}}, etc.</dd>
</dl>

<h3 id="Reporting_directives" name="Reporting_directives">Reporting directives</h3>

<p>Reporting directives control the reporting process of CSP violations. See also the {{HTTPHeader("Content-Security-Policy-Report-Only")}} header.</p>

<dl>
 <dt>{{CSP("report-uri")}}{{deprecated_inline}}</dt>
 <dd>Instructs the user agent to report attempts to violate the Content Security Policy. These violation reports consist of {{Glossary("JSON")}} documents sent via an HTTP <code>POST</code> request to the specified URI.
 <div class="warning">
 <p>Though the {{CSP("report-to")}} directive is intended to replace the deprecated <code><strong>report-uri</strong></code> directive, {{CSP("report-to")}} is not supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get {{CSP("report-to")}} support, you can specify both <code><strong>report-uri</strong></code> and {{CSP("report-to")}}:</p>

 <pre class="syntaxbox notranslate">Content-Security-Policy: ...; report-uri https://endpoint.example.com; report-to groupname</pre>

 <p>In browsers that support {{CSP("report-to")}}, the <code><strong>report-uri</strong></code> directive will be ignored.</p>
 </div>
 </dd>
 <dt>{{CSP("report-to")}}{{experimental_inline}}</dt>
 <dd>Fires a <code>SecurityPolicyViolationEvent</code>.</dd>
</dl>

<h3 id="Other_directives">Other directives</h3>

<dl>
 <dt>{{CSP("block-all-mixed-content")}}</dt>
 <dd>Prevents loading any assets using HTTP when the page is loaded using HTTPS.</dd>
 <dt>{{CSP("referrer")}}{{deprecated_inline}}{{non-standard_inline}}</dt>
 <dd>Used to specify information in the <a href="/en-US/docs/Web/HTTP/Headers/Referer">Referer</a> (sic) header for links away from a page. Use the {{HTTPHeader("Referrer-Policy")}} header instead.</dd>
 <dt>{{CSP("require-sri-for")}}{{experimental_inline}}</dt>
 <dd>Requires the use of {{Glossary("SRI")}} for scripts or styles on the page.</dd>
 <dt>{{CSP("require-trusted-types-for")}}{{experimental_inline}}</dt>
 <dd>Enforces <a href="https://w3c.github.io/webappsec-trusted-types/dist/spec/">Trusted Types</a> at the DOM XSS injection sinks.</dd>
</dl>

<dl>
 <dt>{{CSP("trusted-types")}}{{experimental_inline}}</dt>
 <dd>Used to specify an allow-list of <a href="https://w3c.github.io/webappsec-trusted-types/dist/spec/">Trusted Types</a> policies. Trusted Types allows applications to lock down DOM XSS injection sinks to only accept non-spoofable, typed values in place of strings.</dd>
</dl>

<dl>
 <dt>{{CSP("upgrade-insecure-requests")}}</dt>
 <dd>Instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.</dd>
</dl>

<h2 id="CSP_in_workers">CSP in workers</h2>

<p><a href="/en-US/docs/Web/API/Worker">Workers</a> are in general <em>not</em> governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a <code>Content-Security-Policy</code> response header for the request which requested the worker script itself.</p>

<p>The exception to this is if the worker script's origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker that created it.</p>

<h2 id="Multiple_content_security_policies">Multiple content security policies</h2>

<p>The CSP mechanism allows multiple policies being specified for a resource, including via the <code>Content-Security-Policy</code> header, the {{HTTPHeader("Content-Security-Policy-Report-Only")}} header and a {{HTMLElement("meta")}} element.</p>

<p>You can use the <code>Content-Security-Policy</code> header more than once, as in the example below. Pay special attention to the {{CSP("connect-src")}} directive here. Even though the second policy would allow the connection, the first policy contains <code>connect-src 'none'</code>. Adding additional policies <em>can only further restrict</em> the capabilities of the protected resource, which means that there will be no connection allowed and, as the strictest policy, <code>connect-src 'none'</code> is enforced.</p>

<pre class="notranslate">Content-Security-Policy: default-src 'self' http://example.com;
                         connect-src 'none';
Content-Security-Policy: connect-src http://example.com/;
                         script-src http://example.com/</pre>

<h2 id="Examples">Examples</h2>

<p>Example: Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https:</p>

<pre class="notranslate">// header
Content-Security-Policy: default-src https:

// meta tag
&lt;meta http-equiv="Content-Security-Policy" content="default-src https:"&gt;
</pre>

<p>Example: Pre-existing site that uses too much inline code to fix but wants to ensure resources are loaded only over HTTPS and to disable plugins:</p>

<pre class="notranslate">Content-Security-Policy: default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'</pre>

<p>Example: Do not implement the above policy yet; instead just report violations that would have occurred:</p>

<pre class="notranslate">Content-Security-Policy-Report-Only: default-src https:; report-uri /csp-violation-report-endpoint/</pre>

<p>See <a href="https://infosec.mozilla.org/guidelines/web_security#Examples_5">Mozilla Web Security Guidelines</a> for more examples.</p>

<h2 id="Specifications">Specifications</h2>

<table class="standard-table">
 <thead>
  <tr>
   <th scope="col">Specification</th>
   <th scope="col">Status</th>
   <th scope="col">Comment</th>
  </tr>
 </thead>
 <tbody>
  <tr>
   <td>{{specName("CSP 3.0")}}</td>
   <td>{{Spec2("CSP 3.0")}}</td>
   <td>Adds <code>manifest-src</code>, <code>navigate-to</code>, <code>report-to</code>, <code>strict-dynamic</code>, <code>worker-src</code>. Undeprecates <code>frame-src</code>. Deprecates <code>report-uri</code> in favor if <code>report-to</code>.</td>
  </tr>
  <tr>
   <td>{{specName("Mixed Content")}}</td>
   <td>{{Spec2("Mixed Content")}}</td>
   <td>Adds <code>block-all-mixed-content</code>.</td>
  </tr>
  <tr>
   <td>{{specName("Subresource Integrity")}}</td>
   <td>{{Spec2("Subresource Integrity")}}</td>
   <td>Adds <code>require-sri-for</code>.</td>
  </tr>
  <tr>
   <td>{{specName("Upgrade Insecure Requests")}}</td>
   <td>{{Spec2("Upgrade Insecure Requests")}}</td>
   <td>Adds <code>upgrade-insecure-requests</code>.</td>
  </tr>
  <tr>
   <td>{{specName("CSP 1.1")}}</td>
   <td>{{Spec2("CSP 1.1")}}</td>
   <td>Adds <code>base-uri</code>, <code>child-src</code>, <code>form-action</code>, <code>frame-ancestors</code>, <code>plugin-types</code>, <code>referrer</code>, and <code>report-uri</code>. Deprecates <code>frame-src</code>.</td>
  </tr>
  <tr>
   <td>{{specName("CSP 1.0")}}</td>
   <td>{{Spec2("CSP 1.0")}}</td>
   <td>Defines <code>connect-src</code>, <code>default-src</code>, <code>font-src</code>, <code>frame-src</code>, <code>img-src</code>, <code>media-src</code>, <code>object-src</code>, report-uri, <code>sandbox</code>, <code>script-src,</code> and <code>style-src</code>.</td>
  </tr>
 </tbody>
</table>

<h2 id="Browser_compatibility">Browser compatibility</h2>

<p class="hidden">The compatibility table on this page is generated from structured data. If you'd like to contribute to the data, please check out <a href="https://github.com/mdn/browser-compat-data">https://github.com/mdn/browser-compat-data</a> and send us a pull request.</p>

<p>{{Compat("http.headers.csp.Content-Security-Policy")}}</p>

<h2 id="See_also">See also</h2>

<ul>
 <li>{{HTTPHeader("Content-Security-Policy-Report-Only")}}</li>
 <li><a href="/en-US/docs/Web/HTTP/CSP">Learn about: Content Security Policy</a></li>
 <li><a href="/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy">Content Security in WebExtensions</a></li>
 <li><a href="https://csp.withgoogle.com/docs/strict-csp.html">Adopting a strict policy</a></li>
 <li><a href="https://github.com/google/csp-evaluator">CSP Evaluator</a> - Evaluate your Content Security Policy</li>
</ul>