So in a CSP like the below:

content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' https://stackexchange.com

Should the url part be quoted like this (example from mozilla security [1]) - even though this example has both styles:

# Disable unsafe inline/eval and plugins, only load scripts and stylesheets from same origin, fonts from google,
# and images from same origin and imgur. Sites should aim for policies like this.
Content-Security-Policy: default-src 'none'; font-src 'https://fonts.googleapis.com';
             img-src 'self' https://i.imgur.com; object-src 'none'; script-src 'self'; style-src 'self'

Or unquoted like this:

# Disable unsafe inline/eval, only load resources from same origin except also allow images from imgur
# Also disables the execution of plugins
Content-Security-Policy: default-src 'self'; img-src 'self' https://i.imgur.com; object-src 'none'

[1] Examples from here: https://infosec.mozilla.org/guidelines/web_security#content-security-policy


The standard clearly defines the syntax. In section 4.2 it contains the following:

source-list       = *WSP [ source-expression *( 1*WSP source-expression ) *WSP ]
              / *WSP "'none'" *WSP
source-expression = scheme-source / host-source / keyword-source / nonce-source / hash-source
host-source       = [ scheme-part "://" ] host-part [ port-part ] [ path-part ]
keyword-source    = "'self'" / "'unsafe-inline'" / "'unsafe-eval'"

Based on this URL should not be quoted while keyword sources like 'self', 'unsafe-inline' ... must be quoted. The example you cite where the URL is quoted does not match the standard and is likely wrong.

In fact, when trying to use such a quoted URL Chrome will complain:

The source list for Content Security Policy directive 'font-src' contains an invalid source: ''https://example.com''. It will be ignored.

  • Thanks for looking into this! What are the implications for quoting it? Will real browsers handle it gracefully or just ignore it? – user230910 Oct 14 at 4:12
  • 2
    @user230910: Chrome will ignore it, see updated answer. – Steffen Ullrich Oct 14 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.