recursal/MDN huggingface dataset:
CSP: plugin-types
=================

**Deprecated:** This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

**Non-standard:** This feature is non-standard and is not on a standards track. Do not use it on production sites facing the Web: it will not work for every user. There may also be large incompatibilities between implementations and the behavior may change in the future.

 The HTTP `Content-Security-Policy` (CSP)
 **`plugin-types`** directive restricts the set of plugins that
 can be embedded into a document by limiting the types of resources which can be loaded.

Instantiation of an `<embed>` or `<object>` element will fail if:

* the element to load does not declare a valid MIME type,
* the declared type does not match one of specified types in the
 `plugin-types` directive,
* the fetched resource does not match the declared type.

|  |  |
| --- | --- |
| CSP version | 2 |
| Directive type | Document directive |
| `default-src` fallback | No. Not setting this allows anything. |

Syntax
------

 One or more MIME types can
 be set for the `plugin-types` policy:


```http
Content-Security-Policy: plugin-types <type>/<subtype>;
Content-Security-Policy: plugin-types <type>/<subtype> <type>/<subtype>;
```


<type>/<subtype>

A valid MIME type.

Examples
--------

### Disallowing plugins

 To disallow all plugins, the `object-src` directive should be set to
 `'none'` which will disallow plugins. The `plugin-types` directive
 is only used if you are allowing plugins with `object-src` at all.


```html
<meta http-equiv="Content-Security-Policy" content="object-src 'none'" />
```

Specifications
--------------

Not part of any current specification. Used to be defined in CSP 2.

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`: `object-src`
* `<object>`
* `<embed>`
* `X-Content-Type-Options`
CSP: media-src
==============

 The HTTP `Content-Security-Policy` (CSP)
 **`media-src`** directive specifies valid sources for loading
 media using the `<audio>` and `<video>` elements.


|  |  |
| --- | --- |
| CSP version | 1 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes. If this directive is absent, the user agent will look for the
 `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `media-src` policy:


```http
Content-Security-Policy: media-src <source>;
Content-Security-Policy: media-src <source> <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: media-src https://example.com/
```


 The following `<audio>`, `<video>` and
 `<track>` elements are blocked and won't load:


```html
<audio src="https://not-example.com/audio"></audio>

<video src="https://not-example.com/video">
  <track kind="subtitles" src="https://not-example.com/subtitles" />
</video>
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-media-src |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `<audio>`, `<video>` and `<track>`
CSP: base-uri
=============

The HTTP `Content-Security-Policy` **`base-uri`** directive restricts the URLs which can be used in a document's `<base>` element. If this value is absent, then any URI is allowed. If this directive is absent, the user agent will use the value in the `<base>` element.

|  |  |
| --- | --- |
| CSP version | 2 |
| Directive type | Document directive |
| `default-src` fallback | No. Not setting this allows any URL. |

Syntax
------

One or more *sources* can be allowed for the base-uri policy:


```http
Content-Security-Policy: base-uri <source>;
Content-Security-Policy: base-uri <source> <source>;
```

### Sources

This directive uses most of the same source values for arguments as other CSP directives: CSP Source Values.

Note however that some of the values don't make sense for `base-uri`, such as the keywords `'unsafe-inline'` and `'strict-dynamic'`.

Examples
--------

### Meta tag configuration


```html
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />
```

### Apache configuration


```apacheconf
<IfModule mod\_headers.c>
Header set Content-Security-Policy "base-uri 'self'";
</IfModule>
```

### Nginx configuration


```nginx
add_header Content-Security-Policy "base-uri 'self';"
```

### Violation case

Since your domain isn't `example.com`, a `<base>` element with its `href` set to `https://example.com` will result in a CSP violation.


```html
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />
<base href="https://example.com/" />

<!--
// Error: Refused to set the document's base URI to 'https://example.com/'
// because it violates the following Content Security Policy
// directive: "base-uri 'self'"
-->
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-base-uri |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `<base>`
* `Node.baseURI`
CSP: script-src-elem
====================

The HTTP `Content-Security-Policy` (CSP) **`script-src-elem`** directive specifies valid sources for JavaScript `<script>` elements.

 This directive only specifies valid sources in `<script>` elements (both script requests and blocks).
 It does not apply to other JavaScript sources that can trigger script execution, such as inline script event handlers (`onclick`), script execution methods gated on the "unsafe-eval" check, and XSLT stylesheets.
 (Valid sources can be specified for all JavaScript script sources using `script-src`, or just for inline script handlers using `script-src-attr`.)


|  |  |
| --- | --- |
| CSP version | 3 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes.
 If this directive is absent, the user agent will look for the `script-src` directive, and if both of them are absent, fall back to `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `script-src-elem` policy:


```http
Content-Security-Policy: script-src-elem <source>;
Content-Security-Policy: script-src-elem <source> <source>;
```


`script-src-elem` can be used in conjunction with `script-src`:


```http
Content-Security-Policy: script-src <source>;
Content-Security-Policy: script-src-elem <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation case

Given this CSP header:


```http
Content-Security-Policy: script-src-elem https://example.com/
```


…the following script is blocked and won't be loaded or executed:


```html
<script src="https://not-example.com/js/library.js"></script>
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-script-src-elem |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `<script>`
* `script-src`
* `script-src-attr`
CSP: style-src-elem
===================

The HTTP `Content-Security-Policy` (CSP) **`style-src-elem`** directive specifies valid sources for stylesheet `<style>` elements and `<link>` elements with `rel="stylesheet"`.

The directive does not set valid sources for inline style attributes; these are set using `style-src-attr` (and valid sources for all styles may be set with `style-src`).

|  |  |
| --- | --- |
| CSP version | 3 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes.
 If this directive is absent, the user agent will look for the `style-src` directive, and if both of them are absent, fall back to `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `style-src-elem` policy:


```http
Content-Security-Policy: style-src-elem <source>;
Content-Security-Policy: style-src-elem <source> <source>;
```


`style-src-elem` can be used in conjunction with `style-src`:


```http
Content-Security-Policy: style-src <source>;
Content-Security-Policy: style-src-elem <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: style-src-elem https://example.com/
```


…the following stylesheets are blocked and won't load:


```html
<link href="https://not-example.com/styles/main.css" rel="stylesheet" />

<style>
 #inline-style {
 background: red;
 }
</style>

<style>
 @import url("https://not-example.com/styles/print.css") print;
</style>
```


…as well as styles loaded using the `Link` header:


```http
Link: <https://not-example.com/styles/stylesheet.css>;rel=stylesheet
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-style-src-elem |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `style-src`
* `style-src-attr`
* `Link` header
* `<style>`, `<link>`
* `@import`
* `CSSStyleSheet.insertRule()`
* `CSSGroupingRule.insertRule()`
* `CSSStyleDeclaration.cssText`
CSP: worker-src
===============

 The HTTP `Content-Security-Policy` (CSP)
 **`worker-src`** directive specifies valid sources for
 `Worker`, `SharedWorker`, or `ServiceWorker`
 scripts.


|  |  |
| --- | --- |
| CSP version | 3 |
| Directive type | Fetch directive |
| Fallback | 
 If this directive is absent, the user agent will first look for the
 `child-src` directive, then the
 `script-src` directive, then finally for the
 `default-src` directive, when governing worker
 execution.
  |

Syntax
------

One or more sources can be allowed for the `worker-src` policy:


```http
Content-Security-Policy: worker-src <source>;
Content-Security-Policy: worker-src <source> <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: worker-src https://example.com/
```


`Worker`, `SharedWorker`, `ServiceWorker` are
 blocked and won't load:


```html
<script>
 let blockedWorker = new Worker("data:application/javascript,…");
 blockedWorker = new SharedWorker("https://not-example.com/");
 navigator.serviceWorker.register("https://not-example.com/sw.js");
</script>
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-worker-src |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* CSP for Web Workers
* `Worker`, `SharedWorker`, `ServiceWorker`
CSP: connect-src
================

 The HTTP `Content-Security-Policy` (CSP)
 **`connect-src`** directive restricts the URLs which can be
 loaded using script interfaces. The APIs that are restricted are:

* `<a>` `ping`,
* `fetch()`,
* `XMLHttpRequest`,
* `WebSocket`,
* `EventSource`, and
* `Navigator.sendBeacon()`.

**Note:** `connect-src 'self'` does not resolve to websocket
 schemes in all browsers, more info in this issue.



|  |  |
| --- | --- |
| CSP version | 1 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes. If this directive is absent, the user agent will look for the
 `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the connect-src policy:


```http
Content-Security-Policy: connect-src <source>;
Content-Security-Policy: connect-src <source> <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: connect-src https://example.com/
```


The following connections are blocked and won't load:


```html
<a ping="https://not-example.com">
  <script>
 const response = fetch("https://not-example.com/");

 const xhr = new XMLHttpRequest();
 xhr.open("GET", "https://not-example.com/");
 xhr.send();

 const ws = new WebSocket("wss://not-example.com/");

 const es = new EventSource("https://not-example.com/");

 navigator.sendBeacon("https://not-example.com/", {
 /\* … \*/
 });
 </script></a
>
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-connect-src |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `<a>` `ping`
* `fetch()`
* `XMLHttpRequest`
* `WebSocket`
* `EventSource`
CSP: font-src
=============

 The HTTP `Content-Security-Policy` (CSP)
 **`font-src`** directive specifies
 valid sources for fonts loaded using `@font-face`.


|  |  |
| --- | --- |
| CSP version | 1 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes. If this directive is absent, the user agent will look for the
 `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `font-src` policy:


```http
Content-Security-Policy: font-src <source>;
Content-Security-Policy: font-src <source> <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: font-src https://example.com/
```


The following font resource loading is blocked and won't load:


```html
<style>
 @font-face {
 font-family: "MyFont";
 src: url("https://not-example.com/font");
 }
 body {
 font-family: "MyFont";
 }
</style>
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-font-src |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `@font-face`
CSP: referrer
=============

**Deprecated:** This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

**Non-standard:** This feature is non-standard and is not on a standards track. Do not use it on production sites facing the Web: it will not work for every user. There may also be large incompatibilities between implementations and the behavior may change in the future.

 The HTTP `Content-Security-Policy` (CSP)
 **`referrer`** directive used to specify information in the
 `Referer` header (with a single `r` as this was a typo in the
 original spec) for links away from a page. This API is deprecated and removed from
 browsers.

**Note:** Use the `Referrer-Policy` header instead.

Syntax
------


```http
Content-Security-Policy: referrer <referrer-policy>;
```


where `<referrer-policy>` can be one of the following values:

"no-referrer"

 The `Referer` header will be omitted entirely. No referrer
 information is sent along with requests.


"none-when-downgrade"

 This is the user agent's default behavior if no policy is specified. The origin is
 sent as referrer to a-priori as-much-secure destination (HTTPS->HTTPS), but isn't
 sent to a less secure destination (HTTPS->HTTP).


"origin"

 Only send the origin of the document as the referrer in all cases.
 The document `https://example.com/page.html` will send the referrer
 `https://example.com/`.


"origin-when-cross-origin" / "origin-when-crossorigin"

 Send a full URL when performing a same-origin request, but only send the origin of
 the document for other cases.


"unsafe-url"

 Send a full URL (stripped from parameters) when performing a same-origin or
 cross-origin request. This policy will leak origins and paths from TLS-protected
 resources to insecure origins. Carefully consider the impact of this setting.


Examples
--------


```http
Content-Security-Policy: referrer "none";
```

Specifications
--------------

Not part of any specification.

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `Referrer-Policy` header
* `Referer` header
CSP: script-src-attr
====================

The HTTP `Content-Security-Policy` (CSP) **`script-src-attr`** directive specifies valid sources for JavaScript inline event handlers.

 This directive only specifies valid sources for inline script event handlers like `onclick`.
 It does not apply to other JavaScript sources that can trigger script execution, such as URLs loaded directly into `<script>` elements and XSLT stylesheets.
 (Valid sources can be specified for all JavaScript script sources using `script-src`, or just for `<script>` elements using `script-src-elem`.)


|  |  |
| --- | --- |
| CSP version | 3 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes.
 If this directive is absent, the user agent will look for the `script-src` directive, and if both of them are absent, fallback to `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `script-src-attr` policy:


```http
Content-Security-Policy: script-src-attr <source>;
Content-Security-Policy: script-src-attr <source> <source>;
```


`script-src-attr` can be used in conjunction with `script-src`, and will override that directive for checks on inline handlers:


```http
Content-Security-Policy: script-src <source>;
Content-Security-Policy: script-src-attr <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation case

Given this CSP header:


```http
Content-Security-Policy: script-src-attr 'none'
```


…the following inline event handler is blocked and won't be loaded or executed:


```html
<button id="btn" onclick="doSomething()"></button>
```


Note that generally you should replace inline event handlers with `addEventListener` calls:


```js
document.getElementById("btn").addEventListener("click", doSomething);
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-script-src-attr |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `<script>`
* `script-src`
* `script-src-elem`
CSP: img-src
============

The HTTP `Content-Security-Policy` **`img-src`** directive specifies valid sources of images and favicons.

|  |  |
| --- | --- |
| CSP version | 1 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes. If this directive is absent, the user agent will look for the
 `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `img-src` policy:


```http
Content-Security-Policy: img-src <source>;
Content-Security-Policy: img-src <source> <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: img-src https://example.com/
```


The following `<img>` is blocked and won't load:


```html
<img src="https://not-example.com/foo.jpg" alt="example picture" />
```

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-img-src |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `<img>`
CSP: style-src-attr
===================

The HTTP `Content-Security-Policy` (CSP) **`style-src-attr`** directive specifies valid sources for inline styles applied to individual DOM elements.

 The directive does not set valid sources for `<style>` elements and `<link>` elements with `rel="stylesheet"`.
 These are set using `style-src-elem` (and valid sources for all styles may be set with `style-src`).


|  |  |
| --- | --- |
| CSP version | 3 |
| Directive type | Fetch directive |
| `default-src` fallback | 
 Yes.
 If this directive is absent, the user agent will look for the `style-src` directive, and if both of them are absent, fallback to `default-src` directive.
  |

Syntax
------

One or more sources can be allowed for the `style-src-attr` policy:


```http
Content-Security-Policy: style-src-attr <source>;
Content-Security-Policy: style-src-attr <source> <source>;
```


`style-src-attr` can be used in conjunction with `style-src`:


```http
Content-Security-Policy: style-src <source>;
Content-Security-Policy: style-src-attr <source>;
```

### Sources

`<source>` can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Examples
--------

### Violation cases

Given this CSP header:


```http
Content-Security-Policy: style-src-attr 'none'
```


…the inline style applied to the element below will not be applied:


```html
<div style="display:none">Foo</div>
```


The policy would also block any styles applied in JavaScript by setting the `style` attribute directly, or by setting `cssText`:


```js
document.querySelector("div").setAttribute("style", "display:none;");
document.querySelector("div").style.cssText = "display:none;";
```


Style properties that are set directly on the element's `style` property will not be blocked, allowing users to safely manipulate styles via JavaScript:


```js
document.querySelector("div").style.display = "none";
```


Note that using JavaScript might independently be blocked using the `script-src` CSP directive.

Specifications
--------------

| Specification |
| --- |
| Content Security Policy Level 3 # directive-style-src-attr |

Browser compatibility
---------------------

BCD tables only load in the browser with JavaScript enabled. Enable JavaScript to view data.

See also
--------

* `Content-Security-Policy`
* `style-src`
* `style-src-elem`
* `Link` header
* `<style>`, `<link>`
* `@import`
* `CSSStyleSheet.insertRule()`
* `CSSGroupingRule.insertRule()`
* `CSSStyleDeclaration.cssText`