and 
  * [ ` Navigator.sendBeacon() ` ](/en-US/docs/Web/API/Navigator/sendBeacon) . 

**Note:** ` connect-src 'self' ` does not resolve to websocket schemes in all
browsers, more info in this [ issue ](https://github.com/w3c/webappsec-
csp/issues/7) .

CSP version  |  1   
---|---  
Directive type  |  [ Fetch directive ](/en-US/docs/Glossary/Fetch_directive)  
[ ` default-src ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src) fallback  |  Yes. If this directive is absent, the user agent will look for the ` default-src ` directive.   
  
##  Syntax

One or more sources can be allowed for the connect-src policy:

http

    
    
    Content-Security-Policy: connect-src <source>;
    Content-Security-Policy: connect-src <source> <source>;
    

###  Sources

` <source> ` can be any one of the values listed in [ CSP Source Values ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources) .

Note that this same set of values can be used in all [ fetch directives ](/en-
US/docs/Glossary/Fetch_directive) (and a [ number of other directives ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#relevant_directives)
).

##  Examples

###  Violation cases

Given this CSP header:

http

    
    
    Content-Security-Policy: connect-src https://example.com/
    

The following connections are blocked and won't load:

html

    
    
    <a ping="https://not-example.com">
      <script>
        const response = fetch("https://not-example.com/");
    
        const xhr = new XMLHttpRequest();
        xhr.open("GET", "https://not-example.com/");
        xhr.send();
    
        const ws = new WebSocket("wss://not-example.com/");
    
        const es = new EventSource("https://not-example.com/");
    
        navigator.sendBeacon("https://not-example.com/", {
          /* â¦ */
        });
      </script></a
    >
    

##  Specifications

Specification  
---  
[ Content Security Policy Level 3  
#  directive-connect-src  ](https://w3c.github.io/webappsec-csp/#directive-
connect-src)  
  
##  Browser compatibility

BCD tables only load in the browser  with JavaScript enabled. Enable
JavaScript to view data.

##  See also

  * [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)
  * [ ` <a> ` ](/en-US/docs/Web/HTML/Element/a) [ ` ping ` ](/en-US/docs/Web/HTML/Element/a#ping)
  * [ ` fetch() ` ](/en-US/docs/Web/API/fetch)
  * [ ` XMLHttpRequest ` ](/en-US/docs/Web/API/XMLHttpRequest)
  * [ ` WebSocket ` ](/en-US/docs/Web/API/WebSocket)
  * [ ` EventSource ` ](/en-US/docs/Web/API/EventSource)

##  Help improve MDN

Was this page helpful to you?

Yes  No

[ Learn how to contribute
](https://github.com/mdn/content/blob/main/CONTRIBUTING.md "This will take you
to our contribution guidelines on GitHub.") .

This page was last modified on  Dec 16, 2023  by  [ MDN contributors ](/en-
US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src/contributors.txt)
.

[ View this page on GitHub
](https://github.com/mdn/content/blob/main/files/en-
us/web/http/headers/content-security-policy/connect-src/index.md?plain=1
"Folder: en-us/web/http/headers/content-security-policy/connect-src \(Opens in
a new tab\)") â¢  [ Report a problem with this content
](https://github.com/mdn/content/issues/new?template=page-report.yml&mdn-
url=https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FContent-Security-Policy%2Fconnect-
src&metadata=%3C%21--+Do+not+make+changes+below+this+line+--%3E%0A%3Cdetails%3E%0A%3Csummary%3EPage+report+details%3C%2Fsummary%3E%0A%0A*+Folder%3A+%60en-
us%2Fweb%2Fhttp%2Fheaders%2Fcontent-security-policy%2Fconnect-
src%60%0A*+MDN+URL%3A+https%3A%2F%2Fdeveloper.mozilla.org%2Fen-
US%2Fdocs%2FWeb%2FHTTP%2FHeaders%2FContent-Security-Policy%2Fconnect-
src%0A*+GitHub+URL%3A+https%3A%2F%2Fgithub.com%2Fmdn%2Fcontent%2Fblob%2Fmain%2Ffiles%2Fen-
us%2Fweb%2Fhttp%2Fheaders%2Fcontent-security-policy%2Fconnect-
src%2Findex.md%0A*+Last+commit%3A+https%3A%2F