CSP: base-uri
Baseline Widely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since August 2016.
The HTTP Content-Security-Policy
base-uri
directive restricts the URLs which can be used in a document's <base>
element. If this value is absent, then any URI is allowed. If this directive is absent, the user agent will use the value in the <base>
element.
CSP version | 2 |
---|---|
Directive type | Document directive |
default-src fallback |
No. Not setting this allows any URL. |
Syntax
Content-Security-Policy: base-uri 'none';
Content-Security-Policy: base-uri <source-expression-list>;
This directive may have one of the following values:
'none'
-
No base URI may be set using a
<base>
element. The single quotes are mandatory. <source-expression-list>
-
A space-separated list of source expression values. A
<base>
element may set a base URI if its value matches any of the given source expressions.Source expressions are specified as keyword values or URL patterns: the syntax for each source expression is given in CSP Source Values. However, only the following subset of those values apply to
base-uri
:<host-source>
<scheme-source>
- the keyword value
'self'
.
Examples
Meta tag configuration
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />
Apache configuration
<IfModule mod_headers.c>
Header set Content-Security-Policy "base-uri 'self'";
</IfModule>
Nginx configuration
add_header Content-Security-Policy "base-uri 'self';"
Violation case
Since your domain isn't example.com
, a <base>
element with its href
set to https://example.com
will result in a CSP violation.
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />
<base href="https://example.com/" />
<!--
// Error: Refused to set the document's base URI to 'https://example.com/'
// because it violates the following Content Security Policy
// directive: "base-uri 'self'"
-->
Specifications
Specification |
---|
Content Security Policy Level 3 # directive-base-uri |
Browser compatibility
BCD tables only load in the browser