Content-Security-Policy: frame-src directive
The HTTP Content-Security-Policy (CSP)
frame-src directive specifies valid sources for nested
browsing contexts loading using elements such as frame and
iframe.
NOTE:
frame-srcallows you to specify where iframes in a page may be loaded from. This differs fromframe-ancestors, which allows you to specify what parent source may embed a page.
| CSP version | 1 |
|---|---|
| Directive type | [Fetch directive](https://developer.mozilla.org/en-US/docs/Glossary/Fetch%20directive) |
| Fallback | If this directive is absent, the user agent will look for the [child-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/child-src) directive (which falls back to the [default-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src) directive). |
Syntax
Content-Security-Policy: frame-src 'none';
Content-Security-Policy: frame-src <source-expression-list>;
This directive may have one of the following values:
'none'- : No resources of this type may be loaded. The single quotes are mandatory.
<source-expression-list>- : A space-separated list of source expression values. Resources of this type may be loaded if they match any of the given source expressions. For this directive, the following source expression values are applicable:
Examples
Violation cases
Given this CSP header:
Content-Security-Policy: frame-src https://example.com/
The following iframe is blocked and won't load:
<iframe src="https://not-example.com/"></iframe>
Specifications
Browser compatibility
See also
这篇文档对你有帮助吗？
谢谢你的反馈！