CSP: connect-src

The HTTP Content-Security-Policy (CSP) connect-src directive restricts the URLs which can be loaded using script interfaces. The APIs that are restricted are:

• <a> ping,
• fetch(),
• XMLHttpRequest,
• WebSocket,
• EventSource, and
• Navigator.sendBeacon().

One or more sources can be allowed for the connect-src policy:

Content-Security-Policy: connect-src <source>;
Content-Security-Policy: connect-src <source> <source>;

<source> can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Given this CSP header:

Content-Security-Policy: connect-src https://example.com/

The following connections are blocked and won't load:

<a ping="https://not-example.com">

<script>
  var xhr = new XMLHttpRequest();
  xhr.open('GET', 'https://not-example.com/');
  xhr.send();

  var ws = new WebSocket("https://not-example.com/");

  var es = new EventSource("https://not-example.com/");

  navigator.sendBeacon("https://not-example.com/", { ... });
</script>

• Prior to Firefox 23, xhr-src was used in place of the connect-src directive and only restricted the use of XMLHttpRequest.

• Content-Security-Policy
• <a> ping
• fetch()
• XMLHttpRequest
• WebSocket
• EventSource