Does the connect-src directive block the ability to make a request, or it blocks access to the response?


1 Answer 1


The connect-src directive defines if specific requests can be made in the first place, not how a response gets interpreted. Since all information needed for the decision are there before the request is sent, it would make no sense to sent the request anyway but then throw away the response.

  • Last question for clarification. If the request is SOP allowed, i.e. it is simple or addressed to its own origin, but is forbidden by the connect-src directive, then the request will not be executed at all or it will be executed, but the browser will block reading the response? Commented May 7 at 6:58
  • @NikitaKhodakovsky: same answer - all information for the access control are available before the request is sent. No sense in sending the request anyway but then discarding response. Commented May 7 at 7:00
  • I understand that there is no sense in executing the request, since the information about request prohibition is available before its execution, but browser security mechanisms often act in not the most logical way, so I wanted to clarify whether I understand the mechanism of the connect-src directive correctly. Thank you for your quick reply, you've helped me a lot. Commented May 7 at 8:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .