diff --git a/files/en-us/web/http/headers/content-security-policy/base-uri/index.md b/files/en-us/web/http/headers/content-security-policy/base-uri/index.md index c7b83f6fb8cd392..9ed474b527d3c34 100644 --- a/files/en-us/web/http/headers/content-security-policy/base-uri/index.md +++ b/files/en-us/web/http/headers/content-security-policy/base-uri/index.md @@ -32,18 +32,18 @@ The HTTP {{HTTPHeader("Content-Security-Policy")}} **`base-uri`** directive rest ## Syntax -One or more*sources* can be allowed for the base-uri policy: +One or more *sources* can be allowed for the base-uri policy: -``` +```http Content-Security-Policy: base-uri ; Content-Security-Policy: base-uri ; ``` ### Sources -While this directive uses the same arguments as other CSP directives, some of them don’t make sense for \`\\`, such as the keywords `'unsafe-inline'` and `'strict-dynamic'` +This directive uses most of the same source values for arguments as other CSP directives: [CSP Source Values](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources). -{{page("Web/HTTP/Headers/Content-Security-Policy/default-src", "Sources")}} +Note however that some of the values don't make sense for `base-uri`, such as the keywords `'unsafe-inline'` and `'strict-dynamic'`. ## Examples diff --git a/files/en-us/web/http/headers/content-security-policy/child-src/index.md b/files/en-us/web/http/headers/content-security-policy/child-src/index.md index 30531d6d114e00c..b6f458180e6dad7 100644 --- a/files/en-us/web/http/headers/content-security-policy/child-src/index.md +++ b/files/en-us/web/http/headers/content-security-policy/child-src/index.md @@ -43,16 +43,18 @@ network errors by the user agent. ## Syntax -One or more sources can be allowed for the child-src policy: +One or more sources can be allowed for the `child-src` policy: -``` +```http Content-Security-Policy: child-src ; Content-Security-Policy: child-src ; ``` ### Sources -{{page("Web/HTTP/Headers/Content-Security-Policy/connect-src", "Sources")}} +`` can be any one of the values listed in [CSP Source Values](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources). + +Note that this same set of values can be used in all {{Glossary("fetch directive", "fetch directives")}} (and a [number of other directives](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#relevant_directives)). ## Examples @@ -60,7 +62,7 @@ Content-Security-Policy: child-src ; Given this CSP header: -``` +```http Content-Security-Policy: child-src https://example.com/ ``` diff --git a/files/en-us/web/http/headers/content-security-policy/connect-src/index.md b/files/en-us/web/http/headers/content-security-policy/connect-src/index.md index b5002994e76b8a5..263d6bc3c09827d 100644 --- a/files/en-us/web/http/headers/content-security-policy/connect-src/index.md +++ b/files/en-us/web/http/headers/content-security-policy/connect-src/index.md @@ -52,14 +52,16 @@ loaded using script interfaces. The APIs that are restricted are: One or more sources can be allowed for the connect-src policy: -``` +```http Content-Security-Policy: connect-src ; Content-Security-Policy: connect-src ; ``` ### Sources -{{page("Web/HTTP/Headers/Content-Security-Policy/default-src", "Sources")}} +`` can be any one of the values listed in [CSP Source Values](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources). + +Note that this same set of values can be used in all {{Glossary("fetch directive", "fetch directives")}} (and a [number of other directives](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#relevant_directives)). ## Examples @@ -67,7 +69,7 @@ Content-Security-Policy: connect-src ; Given this CSP header: -``` +```http Content-Security-Policy: connect-src https://example.com/ ``` diff --git a/files/en-us/web/http/headers/content-security-policy/default-src/index.md b/files/en-us/web/http/headers/content-security-policy/default-src/index.md index 71b31cf105aa8f3..68e2305e577abdc 100644 --- a/files/en-us/web/http/headers/content-security-policy/default-src/index.md +++ b/files/en-us/web/http/headers/content-security-policy/default-src/index.md @@ -58,49 +58,9 @@ Content-Security-Policy: default-src ; ### Sources -\ can be one of the following: +`` can be any one of the values listed in [CSP Source Values](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#sources). -- `` - - - : Internet hosts by name or IP address, as well as an optional [URL scheme](/en-US/docs/Learn/Common_questions/What_is_a_URL) and/or port number. The site's address may include an optional leading wildcard (the asterisk character, `'*'`), and you may use a wildcard (again, `'*'`) as the port number, indicating that all legal ports are valid for the source. - Examples: - - - `http://*.example.com`: Matches all attempts to load from any subdomain of example.com using the `http:` URL scheme. - - `mail.example.com:443`: Matches all attempts to access port 443 on mail.example.com. - - `https://store.example.com`: Matches all attempts to access store.example.com using `https:`. - - `*.example.com`: Matches all attempts to load from any subdomain of example.com using the current protocol. - -- `` - - - : A scheme such as `http:` or `https:`. The colon is required. Unlike other values below, single quotes shouldn't be used. You can also specify data schemes (not recommended). - - - `data:` Allows [`data:` URIs](/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URIs) to be used as a content source. _This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts._ - - `mediastream:` Allows [`mediastream:` URIs](/en-US/docs/Web/API/Media_Streams_API) to be used as a content source. - - `blob:` Allows [`blob:` URIs](/en-US/docs/Web/API/Blob) to be used as a content source. - - `filesystem:` Allows [`filesystem:` URIs](/en-US/docs/Web/API/FileSystem) to be used as a content source. - -- `'self'` - - : Refers to the origin from which the protected document is being served, including the same URL scheme and port number. You must include the single quotes. Some browsers specifically exclude `blob` and `filesystem` from source directives. Sites needing to allow these content types can specify them using the Data attribute. -- `'unsafe-eval'` - - : Allows the use of `eval()` and similar methods for creating code from strings. You must include the single quotes. -- `'unsafe-hashes'` - - : Allows enabling specific inline [event handlers](/en-US/docs/Web/Events/Event_handlers). If you only need to allow inline event handlers and not inline {{HTMLElement("script")}} elements or `javascript:` URLs, this is a safer method than using the `unsafe-inline` expression. -- `'unsafe-inline'` - - : Allows the use of inline resources, such as inline {{HTMLElement("script")}} elements, `javascript:` URLs, inline event handlers, and inline {{HTMLElement("style")}} elements. The single quotes are required. -- `'none'` - - : Refers to the empty set; that is, no URLs match. The single quotes are required. -- `'nonce-'` - - - : An allow-list for specific inline scripts using a cryptographic nonce (number used once). The server must generate a unique nonce value each time it transmits a policy. It is critical to provide an unguessable nonce, as bypassing a resource's policy is otherwise trivial. See [unsafe inline script](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_inline_script) for an example. Specifying nonce makes a modern browser ignore `'unsafe-inline'` which could still be set for older browsers without nonce support. - - > **Note:** The CSP `nonce` source can only be applied to _nonceable_ elements (e.g., as the {{HTMLElement("img")}} element has no `nonce` attribute, there is no way to associate it with this CSP source). - -- `'-'` - - : A sha256, sha384 or sha512 hash of scripts or styles. The use of this source consists of two portions separated by a dash: the encryption algorithm used to create the hash and the base64-encoded hash of the script or style. When generating the hash, don't include the \