What is the behaviour of directives that would normally fall back to
default-src which are not specified such as img-src or frame-src? Will
they default to open (allow everything) or default to closed (allow
A distinction should be made between 2 situations:
directive is specified with empty list of sources, ex,
style-src ;. Empty source list means 'as much restrictive as possible", for the
style-src it's equal to
no directive specified at all. Common rule: if directive is not specified - it is allowed everything what's this directive controls.
But in the CSP was implemented a fallback mechanism for some directives, therefore those can be implicitly setted even not specified.
And here the devil hides in the details because those not always inites from default-src... Let's see your example below:
Imagine a simple CSP like
Content-Security-Policy: script-src 'self'
What is the behaviour of directives that would normally fall back to default-src
So we have the
worker-src directive not specified and
default-src too (means no restrictions if fallback). Are workers allowed from any sources o not?
The answer is:
- Edge browser: yes, all workers are allowed from any source
- other browsers: workers are allowed from 'self' only.
That's because a fallback performs more complicated way:
worker-src does fallback to
default-src only if absent
script-src (Edge erroneously skips script-src in this chain).
Hence we have an additional rule:
- Fetch-directives do fallback if omitted, but
default-src is a final fallback, and some directives has an intermediate ones.
The above is a theoretical part of CSP spec. Some devils also hides in a practice of realisation too. Therefore it is a rule 4:
- Don't rely on initiation via
default-src in complicated cases, it not always work according to spec. Do specify directives explicitly.