Directive: connect src

Overview

The connect-src directive restricts the URLs which can be loaded using script interfaces.

Affects: fetch(), XMLHttpRequest; WebSocket; EventSource; <a ping>; the navigator.sendBeacon() method.

Note

Older versions of Chrome and Safari had an issue where connect-src: 'self' did not cover WebSockets (ws: and wss:) when the page was served over https:. This was fixed in Chrome 71 (Sept 2018), Safari Technology Preview 144 (May 2022), and Safari 16 (Sept 2022).

If you need to support those older browsers, work around this by including wss: and the specific domain (replacing example.com with your own domain).

connect-src 'self' wss://example.com ws://example.com

Required reading:

• Can I use connect-src?
• MDN Web Docs reference

Usage examples

Accepts one or more schemes or hosts, the 'self' keyword, or the 'none' keyword.

connect-src 'none'

connect-src 'self'

connect-src example.com

connect-src example.com example.org

connect-src https://*.example.com

connect-src https:

Fallbacks

✅ connect-src will fallback to default-src if it is undefined.

• default-src
  • connect-src

Possible errors

• CSP-0100 — [ERROR] directive %s has an invalid value %s

For developers

ABNF (CSP3)

directive-name  = "connect-src"
directive-value = serialized-source-list

See ABNF: serialized-source-list

Type

• source-list in CSP2
• serialized-source-list in CSP3

References

• CSP Level 2 reference
• CSP Level 3 reference
• MDN Web Docs reference
• Can I use connect-src?