HTTP 中文开发手册
简体中文(ZH-CN) English(EN) 繁体中文(ZH-TW) 日本語(JA) 한국어(KO) Melayu(MS) Français(FR) Deutsch(DE)
directory search
Guides Access control CORS Authentication Browser detection using the user agent Caching Caching FAQ Compression Conditional requests Connection management in HTTP 1.x Content negotiation Content negotiation: List of default Accept values Cookies CSP Messages Overview Protocol upgrade mechanism Proxy servers and tunneling Proxy servers and tunneling: Proxy Auto-Configuration (PAC) file Public Key Pinning Range requests Redirections Resources and specifications Resources and URIs Response codes Server-Side Access Control Session Guides: Basics Basics of HTTP Choosing between www and non-www URLs Data URIs Evolution of HTTP Identifying resources on the Web MIME Types MIME types: Complete list of MIME types CSP Content-Security-Policy Content-Security-Policy-Report-Only CSP: base-uri CSP: block-all-mixed-content CSP: child-src CSP: connect-src CSP: default-src CSP: font-src CSP: form-action CSP: frame-ancestors CSP: frame-src CSP: img-src CSP: manifest-src CSP: media-src CSP: object-src CSP: plugin-types CSP: referrer CSP: report-uri CSP: require-sri-for CSP: sandbox CSP: script-src CSP: style-src CSP: upgrade-insecure-requests CSP: worker-src Headers Accept Accept-Charset Accept-Encoding Accept-Language Accept-Ranges Access-Control-Allow-Credentials Access-Control-Allow-Headers Access-Control-Allow-Methods Access-Control-Allow-Origin Access-Control-Expose-Headers Access-Control-Max-Age Access-Control-Request-Headers Access-Control-Request-Method Age Allow Authorization Cache-Control Connection Content-Disposition Content-Encoding Content-Language Content-Length Content-Location Content-Range Content-Type Cookie Cookie2 Date DNT ETag Expect Expires Forwarded From Headers Host If-Match If-Modified-Since If-None-Match If-Range If-Unmodified-Since Keep-Alive Large-Allocation Last-Modified Location Origin Pragma Proxy-Authenticate Proxy-Authorization Public-Key-Pins Public-Key-Pins-Report-Only Range Referer Referrer-Policy Retry-After Server Set-Cookie Set-Cookie2 SourceMap Strict-Transport-Security TE Tk Trailer Transfer-Encoding Upgrade-Insecure-Requests User-Agent User-Agent: Firefox Vary Via Warning WWW-Authenticate X-Content-Type-Options X-DNS-Prefetch-Control X-Forwarded-For X-Forwarded-Host X-Forwarded-Proto X-Frame-Options X-XSS-Protection Methods CONNECT DELETE GET HEAD Methods OPTIONS PATCH POST PUT Status 100 Continue 101 Switching Protocols 200 OK 201 Created 202 Accepted 203 Non-Authoritative Information 204 No Content 205 Reset Content 206 Partial Content 300 Multiple Choices 301 Moved Permanently 302 Found 303 See Other 304 Not Modified 307 Temporary Redirect 308 Permanent Redirect 400 Bad Request 401 Unauthorized 403 Forbidden 404 Not Found 405 Method Not Allowed 406 Not Acceptable 407 Proxy Authentication Required 408 Request Timeout 409 Conflict 410 Gone 411 Length Required 412 Precondition Failed 413 Payload Too Large 414 URI Too Long 415 Unsupported Media Type 416 Range Not Satisfiable 417 Expectation Failed 426 Upgrade Required 428 Precondition Required 429 Too Many Requests 431 Request Header Fields Too Large 451 Unavailable For Legal Reasons 500 Internal Server Error 501 Not Implemented 502 Bad Gateway 503 Service Unavailable 504 Gateway Timeout 505 HTTP Version Not Supported 511 Network Authentication Required Status

©
This document usesPHP Chinese website manualRelease

characters

HTTPContent-Security-Policy（CSP）指令限制可以使用脚本接口加载的URL。受限制的API是：connect-src

  • Fetch,

  • XMLHttpRequest,

  • WebSocket，和

  • EventSource.

CSP版本

1

指令类型

取指令

默认-src后备

是。如果此指令不存在，用户代理将查找default-src指令。

句法

可以为 connect-src 策略允许一个或多个源：

Content-Security-Policy: connect-src ;Content-Security-Policy: connect-src  ;

来源

可以是以下之一：

通过名称或IP地址的 Internet主机，以及可选的 URL方案and/or 端口号。该站点的地址可能包含一个可选的前导通配符（星号字符'*'），并且可以使用通配符（再次'*'）作为端口号，表示所有合法端口对于源都有效。

示例：

  • http://*.example.com：匹配使用http:URL方案从 example.com 的任何子域加载的所有尝试。

  • mail.example.com:443：匹配所有尝试访问 mail.example.com 上的端口443的尝试。

  • https://store.example.com：匹配所有尝试访问 store.example.com 使用https:。

一种模式，如'http:' 或 'https:'。冒号是必需的，不应使用单引号。您也可以指定数据模式（不推荐）。

  • data:允许将data:URI用作内容源。这是不安全的；攻击者也可以注入任意数据：URI。谨慎使用这一点，绝对不适用于脚本。

  • mediastream:允许将mediastream:URI 用作内容源。

  • blob:允许将blob:URI 用作内容源。

  • filesystem:允许将filesystem:URI 用作内容源。

'self'指受保护文档的来源，包括相同的URL方案和端口号。你必须包括单引号。一些浏览器特别排除blob和filesystem从源指令。需要允许这些内容类型的网站可以使用Data属性来指定它们。

'unsafe-inline'允许使用内联资源，如内联

规范

规范

状态

评论

内容安全策略级别3该规范中'connect-src'的定义。

编辑草稿

没有变化。

内容安全策略级别2该规范中'connect-src'的定义。

建议

初始定义。

浏览器兼容性

特征

Chrome

Firefox

Edge

Internet Explorer

Opera

Safari

基本支持

25

23.01

14

(No)

15

7

特征

Android

Chrome for Android

Edge mobile

Firefox for Android

IE mobile

Opera Android

iOS Safari

基本支持

4.4

(Yes)

?

23.0

(No)

?

7.1

  1. 在Firefox 50之前，元素的ping属性未被connect-src.Compatibility注释覆盖

2. 在Firefox 23之前，xhr-src被用来代替connect-src指 令，并且仅限于使用XMLHttpRequest。

Previous article： Next article：