CSP default-src
The fallback for most fetch directives. Setting it does not cover everything.
- Falls back to
- nothing — must be set explicitly
- Group
- Fetch directives
Detail
default-src supplies a value for fetch directives that are absent — script-src, img-src, connect-src and so on. It does NOT cover base-uri, form-action, frame-ancestors, sandbox or report-to. A policy of just default-src 'self' therefore leaves base tag injection and form hijacking wide open.
Example
default-src 'self'