The HTTP Content-Security-Policy
(CSP) worker
-src
directive specifies valid sources for Worker
, SharedWorker
, or ServiceWorker
scripts.
CSP version | 3 |
---|---|
Directive type | Fetch directive |
Fallback | If this directive is absent, the user agent will look for the child-src directive (which falls back to the default-src directive). |
One or more sources can be allowed for the worker-src
policy:
Content-Security-Policy: worker-src <source>; Content-Security-Policy: worker-src <source> <source>;
<source> can be one of the following:
'*'
), and you may use a wildcard (again, '*'
) as the port number, indicating that all legal ports are valid for the source.http://*.example.com
: Matches all attempts to load from any subdomain of example.com using the http:
URL scheme.mail.example.com:443
: Matches all attempts to access port 443 on mail.example.com.https://store.example.com
: Matches all attempts to access store.example.com using https:
.data:
Allows data:
URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts.
mediastream:
Allows mediastream:
URIs to be used as a content source.blob:
Allows blob:
URIs to be used as a content source.filesystem:
Allows filesystem:
URIs to be used as a content source.'self'
blob
and filesystem
from source directives. Sites needing to allow these content types can specify them using the Data attribute.'unsafe-inline'
<script>
elements, javascript:
URLs, inline event handlers, and inline <style>
elements. You must include the single quotes.'unsafe-eval'
eval()
and similar methods for creating code from strings. You must include the single quotes.'none'
strict-dynamic
source expression specifies that the trust explicitly given to a script present in the markup, by accompanying it with a nonce or a hash, shall be propagated to all the scripts loaded by that root script. At the same time, any whitelist or source expressions such as 'self'
or 'unsafe-inline'
will be ignored. See script-src for an example.Given this CSP header:
Content-Security-Policy: worker-src https://example.com/
Worker
, SharedWorker
, ServiceWorker
are blocked and won't load:
<script> var blockedWorker = new Worker("data:application/javascript,..."); blockedWorker = new SharedWorker("https://not-example.com/"); navigator.serviceWorker.register('https://not-example.com/sw.js'); </script>
Specification | Status | Comment |
---|---|---|
Content Security Policy Level 3 The definition of 'worker-src' in that specification. | Editor's Draft | Initial definition. |
Feature | Chrome | Edge | Firefox | Internet Explorer | Opera | Safari | Servo |
---|---|---|---|---|---|---|---|
Basic Support | 56 | No support | No support1 | No support | No support | No support | ? |
Feature | Android | Chrome for Android | Edge Mobile | Firefox for Android | IE Mobile | Opera Mobile | Safari Mobile |
---|---|---|---|---|---|---|---|
Basic Support | ? | ? | No support | No support | No support | No support | No support |
1. See Bugzilla bug 1302667.
© 2005–2017 Mozilla Developer Network and individual contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/worker-src