0

If I have the following script-src directive:

script-src: https://example.com/scripts/file.js;

Is it possible for any of the following scripts to be loaded?

  1. https://example.com/file.js
  2. https://example.com/assets/file.js
  3. https://example.com/scripts/different-file.js

Does this apply to all browsers and CSP v2 / CSP v3?

jhancock532
  • 93
  • 8

1 Answers1

1

According to the specifications for CSP v2 and CSP v3, this can be used in both v2 and v3. I would expect browsers to support it as major browsers have supported v2 for years. None of the example scripts should be loaded with the given CSP.

Halvor Sakshaug
  • 2,583
  • 1
  • 6
  • 9