The HTTP Content-Security-Policy
(CSP) frame-src
directive specifies valid sources for nested browsing contexts loading using elements such as <frame>
and <iframe>
.
CSP version | 1 |
---|---|
Directive type | Fetch directive |
Fallback | If this directive is absent, the user agent will look for the child-src directive (which falls back to the default-src directive). |
One or more sources can be allowed for the frame-src
policy:
Content-Security-Policy: frame-src <source>; Content-Security-Policy: frame-src <source> <source>;
<source> can be one of the following:
'*'
), and you may use a wildcard (again, '*'
) as the port number, indicating that all legal ports are valid for the source.http://*.example.com
: Matches all attempts to load from any subdomain of example.com using the http:
URL scheme.mail.example.com:443
: Matches all attempts to access port 443 on mail.example.com.https://store.example.com
: Matches all attempts to access store.example.com using https:
.data:
Allows data:
URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts.
mediastream:
Allows mediastream:
URIs to be used as a content source.blob:
Allows blob:
URIs to be used as a content source.filesystem:
Allows filesystem:
URIs to be used as a content source.'self'
blob
and filesystem
from source directives. Sites needing to allow these content types can specify them using the Data attribute.'unsafe-inline'
<script>
elements, javascript:
URLs, inline event handlers, and inline <style>
elements. You must include the single quotes.'unsafe-eval'
eval()
and similar methods for creating code from strings. You must include the single quotes.'none'
script-src
for external scripts.strict-dynamic
source expression specifies that the trust explicitly given to a script present in the markup, by accompanying it with a nonce or a hash, shall be propagated to all the scripts loaded by that root script. At the same time, any whitelist or source expressions such as 'self'
or 'unsafe-inline'
will be ignored. See script-src for an example.Given this CSP header:
Content-Security-Policy: frame-src https://example.com/
The following <frame>
is blocked and won't load:
<iframe src="https://not-example.com/"></iframe>
Specification | Status | Comment |
---|---|---|
Content Security Policy Level 3 The definition of 'frame-src' in that specification. | Editor's Draft | Undeprecates frame-src . |
Content Security Policy Level 2 The definition of 'frame-src' in that specification. | Recommendation | Deprecates frame-src . |
Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari |
---|---|---|---|---|---|---|
Basic support | 25 | 14 | 23 | No | 15 | 7 |
Feature | Android webview | Chrome for Android | Edge mobile | Firefox for Android | IE mobile | Opera Android | iOS Safari |
---|---|---|---|---|---|---|---|
Basic support | Yes | Yes | ? | 23 | No | ? | 7.1 |
© 2005–2018 Mozilla Developer Network and individual contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src