Search code examples
content-security-policyscript-src

Does specifying a file in a CSP directive prevent other files from that domain being loaded?

If I have the following script-src directive:

script-src: https://example.com/scripts/file.js;

Is it possible for any of the following scripts to be loaded?

  1. https://example.com/file.js
  2. https://example.com/assets/file.js
  3. https://example.com/scripts/different-file.js

Does this apply to all browsers and CSP v2 / CSP v3?

Solution

  • According to the specifications for CSP v2 and CSP v3, this can be used in both v2 and v3. I would expect browsers to support it as major browsers have supported v2 for years. None of the example scripts should be loaded with the given CSP.