Content-Security-Policy

The Content-Security-Policy header fields allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks.

To set a content security policy, add one or more policy directives to either of the response headers listed below. Alternatively, most policy directives can be used in a <meta> tag with the http-equiv attribute. If a policy directive is not defined, user agents will allow resources from anywhere.  The default-src directive overrides this behavior for a select number of other directives. See the policy directives page for more information.

Workers are in general not governed by the content security policy of the document (or parent worker) that created them. To specify a content security policy for the worker, set a Content-Security-Policy response header for the request which delivered the worker script itself.

The exception to this is if the worker script's origin is a globally unique identifier (for example, if its URL has a scheme of data or blob). In this case, the worker does inherit the content security policy of the document or worker than created it.

The HTTP response headers

This section lists the HTTP response headers that servers send back to specify allowed origins for page contents as defined by the Content Security Policy specification. 

CH-CSP

Indicates that a request is subject to a policy.

Content-Security-Policy

Specifies a page's content origins by resource type for enforcement by the user agent. This header may be used inside a <meta> tag.

Content-Security-Policy-Report-Only

Specifies a page's content origins by resource type for monitoring by the server. This header may not be used inside a <meta> tag.

Browser compatibility

See Also

• Using Content Security Policy
• CSP Policy Directives