y/encrypted-media) Experimental 
    11. [ Permissions-Policy: execution-while-not-rendered ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/execution-while-not-rendered) Experimental 
    12. [ Permissions-Policy: execution-while-out-of-viewport ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/execution-while-out-of-viewport) Experimental 
    13. [ Permissions-Policy: fullscreen ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/fullscreen)
    14. [ Permissions-Policy: gamepad ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/gamepad) Experimental 
    15. [ Permissions-Policy: geolocation ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/geolocation)
    16. [ Permissions-Policy: gyroscope ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/gyroscope) Experimental 
    17. [ Permissions-Policy: hid ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/hid) Experimental 
    18. [ Permissions-Policy: identity-credentials-get ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/identity-credentials-get) Experimental 
    19. [ Permissions-Policy: idle-detection ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/idle-detection) Experimental 
    20. [ Permissions-Policy: local-fonts ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/local-fonts) Experimental 
    21. [ Permissions-Policy: magnetometer ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/magnetometer) Experimental 
    22. [ Permissions-Policy: microphone ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/microphone)
    23. [ Permissions-Policy: midi ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/midi) Experimental 
    24. [ Permissions-Policy: otp-credentials ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/otp-credentials) Experimental 
    25. [ Permissions-Policy: payment ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/payment) Experimental 
    26. [ Permissions-Policy: picture-in-picture ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/picture-in-picture) Experimental 
    27. [ Permissions-Policy: publickey-credentials-create ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/publickey-credentials-create) Experimental 
    28. [ Permissions-Policy: publickey-credentials-get ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/publickey-credentials-get)
    29. [ Permissions-Policy: screen-wake-lock ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/screen-wake-lock)
    30. [ Permissions-Policy: serial ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/serial) Experimental 
    31. [ Permissions-Policy: speaker-selection ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/speaker-selection) Experimental 
    32. [ Permissions-Policy: storage-access ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/storage-access) Experimental 
    33. [ Permissions-Policy: usb ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/usb) Experimental 
    34. [ Permissions-Policy: web-share ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/web-share)
    35. [ Permissions-Policy: window-management ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/window-management) Experimental 
    36. [ Permissions-Policy: xr-spatial-tracking ](/en-US/docs/Web/HTTP/Headers/Permissions-Policy/xr-spatial-tracking) Experimental 

##  In this article

  * Syntax 
  * Examples 
  * Specifications 
  * Browser compatibility 
  * See also 

#  CSP: object-src

The HTTP [ ` Content-Security-Policy ` ](/en-US/docs/Web/HTTP/Headers/Content-
Security-Policy) **` object-src ` ** directive specifies valid sources for the
[ ` <object> ` ](/en-US/docs/Web/HTML/Element/object) and [ ` <embed> ` ](/en-
US/docs/Web/HTML/Element/embed) elements.

To set allowed types for [ ` <object> ` ](/en-US/docs/Web/HTML/Element/object)
and [ ` <embed> ` ](/en-US/docs/Web/HTML/Element/embed) , use the [ ` plugin-
types ` ](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/plugin-types)
directive.

**Note:** Elements controlled by ` object-src ` are perhaps coincidentally
considered legacy HTML elements and aren't receiving new stand