CSP connect-src

Where fetch, XHR, WebSocket and EventSource may connect.

Falls back to

default-src

Group

Fetch directives

Detail

This is the exfiltration directive. Even with script execution blocked, an injected page can read the DOM and POST it somewhere — unless connect-src stops it. Remember to include WebSocket origins explicitly, as wss:// is not covered by an https:// entry.

Example

Analyse a full policy → · Generate one →