CSP: font-src - HTTP

在此页

句法
范例
规范
浏览器兼容性
另请参阅
相关话题

The HTTP Content-Security-Policy (CSP) font -src directive specifies valid sources for fonts loaded using @font-face .

CSP version	1
Directive type	Fetch directive
`default-src` fallback	Yes. If this directive is absent, the user agent will look for the `default-src` directive.

句法

One or more sources can be allowed for the font-src policy:

Content-Security-Policy: font-src <source>;
Content-Security-Policy: font-src <source> <source>;

Sources

<source> can be one of the following:

<host-source>

Internet hosts by name or IP address, as well as an optional URL scheme and/or port number. The site's address may include an optional leading wildcard (the asterisk character,

'*'

), and you may use a wildcard (again,

'*'

) as the port number, indicating that all legal ports are valid for the source.
范例：

http://*.example.com : Matches all attempts to load from any subdomain of example.com using the http: URL scheme.
mail.example.com:443 : Matches all attempts to access port 443 on mail.example.com.
https://store.example.com : Matches all attempts to access store.example.com using https: .
*.example.com : Matches all attempts to load from any subdomain of example.com using the current protocol.

<scheme-source>

A scheme such as


http:


https:

. The colon is required. Unlike other values below, single quotes shouldn't be used. You can also specify data schemes (not recommended).

data: Allows data: URIs to be used as a content source. This is insecure; an attacker can also inject arbitrary data: URIs. Use this sparingly and definitely not for scripts.
mediastream: Allows mediastream: URIs to be used as a content source.
blob: Allows blob: URIs to be used as a content source.
filesystem: Allows filesystem: URIs to be used as a content source.

'self'

Refers to the origin from which the protected document is being served, including the same URL scheme and port number. You must include the single quotes. Some browsers specifically exclude


blob

and


filesystem

from source directives. Sites needing to allow these content types can specify them using the Data attribute.

'unsafe-eval'

Allows the use of


eval()

and similar methods for creating code from strings. You must include the single quotes.

'unsafe-hashes'

Allows enabling specific inline 事件处理程序 . If you only need to allow inline event handlers and not inline


<script>

elements or


javascript:

URLs, this is a safer method than using the


unsafe-inline

表达式。

'unsafe-inline'

Allows the use of inline resources, such as inline


<script>

elements,


javascript:

URLs, inline event handlers, and inline


<style>

elements. The single quotes are required.

'none'

Refers to the empty set; that is, no URLs match. The single quotes are required.

'nonce-<base64-value>'

An allow-list for specific inline scripts using a cryptographic nonce (number used once). The server must generate a unique nonce value each time it transmits a policy. It is critical to provide an unguessable nonce, as bypassing a resource’s policy is otherwise trivial. See unsafe inline script for an example. Specifying nonce makes a modern browser ignore


'unsafe-inline'

which could still be set for older browsers without nonce support.

'<hash-algorithm>-<base64-value>'

A sha256, sha384 or sha512 hash of scripts or styles. The use of this source consists of two portions separated by a dash: the encryption algorithm used to create the hash and the base64-encoded hash of the script or style. When generating the hash, don't include the <script> or <style> tags and note that capitalization and whitespace matter, including leading or trailing whitespace. See unsafe inline script for an example. In CSP 2.0, this applied only to inline scripts. CSP 3.0 allows it in the case of


script-src

for external scripts.

范例

Violation cases

Given this CSP header:

Content-Security-Policy: font-src https://example.com/

The following font resource loading is blocked and won't load:

<style>
  @font-face {
    font-family: "MyFont";
    src: url("https://not-example.com/font");
  }
  body {
    font-family: "MyFont";
  }
</style>

规范

规范	状态	注释
Content Security Policy Level 3 The definition of 'font-src' in that specification.	工作草案	No changes.
Content Security Policy Level 2 The definition of 'font-src' in that specification.	推荐	初始定义。

浏览器兼容性

更新 GitHub 上的兼容性数据

	Desktop						Mobile
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	Android webview	Chrome for Android	Firefox for Android	Opera for Android	Safari on iOS	Samsung Internet
`font-src`	Chrome 完整支持 25	Edge 完整支持 14	Firefox 完整支持 23	IE 不支持 No	Opera 完整支持 15	Safari 完整支持 7	WebView Android 完整支持 Yes	Chrome Android 完整支持 Yes	Firefox Android 完整支持 23	Opera Android ?	Safari iOS 完整支持 7	Samsung Internet Android 完整支持 Yes

在此页

句法

Sources

范例

Violation cases

规范

浏览器兼容性

图例

另请参阅

元数据

相关话题