CSP base-uri

Restricts the <base> tag. Missing from most policies, and its absence undoes nonce-based CSP.

Falls back to

nothing — must be set explicitly

Group

Document and navigation directives

Detail

An injected rewrites every relative URL on the page, including relative script sources — which means an attacker can redirect your own nonce-approved scripts to their server. It does not fall back to default-src, so a policy without it is missing the protection regardless of how strict default-src is. base-uri 'self' or 'none' closes it.

Example

Analyse a full policy → · Generate one →