Directive: child src

Overview

Caution

Obsolete: This feature is no longer recommended. While the specification doesn't use the word deprecated, you are strongly advised to use worker-src for Web Worker management, and frame-src for nested browsing contexts (e.g., frame and iframe).

Support for both modern directives has been available for many years, so we've changed this from a ⚠️ Warning to an 🚫 Error.

The child-src directive governs the creation of nested browsing contexts (e.g., frame and iframe) as well as Worker execution contexts.

Affects: <frame> and <iframe> elements; Web Workers (in some browsers).

Required reading:

• Can I use child-src?
• MDN Web Docs reference

Usage examples

Accepts one or more schemes or hosts, the 'self' keyword, or the 'none' keyword.

child-src 'none'

child-src 'self'

child-src example.com

child-src example.com example.org

child-src https://*.example.com

child-src https:

Fallbacks

✅ child-src will fallback to default-src if it is undefined.

• default-src
  • child-src

Possible errors

• CSP-0100 — [ERROR] directive %s has an invalid value %s
• CSP-0802 — [ERROR] directive child-src is deprecated; use frame-src and/or worker-src instead

For developers

ABNF (CSP3)

directive-name  = "child-src"
directive-value = serialized-source-list

See ABNF: serialized-source-list

Type

• source-list in CSP2
• serialized-source-list in CSP3

References

• CSP Level 2 reference
• CSP Level 3 reference
• MDN Web Docs reference
• Can I use child-src?