X-WebKit-CSP
Before the Content Security Policy standard was finalized, early Safari and Chrome relied on the X-WebKit-CSP unofficial response header as WebKit's vendor-prefixed version of Content-Security-Policy.
Usage
Older WebKit-based browsers (early Safari and Chrome
releases) used the X-WebKit-CSP header for Content
Security Policy enforcement. At the same time, Firefox
used
X-Content-Security-Policy
as its own vendor-prefixed variant. X-WebKit-CSP
accepted the same directive syntax as the standard
Content-Security-Policy
header, while early Firefox releases used a
pre-standard syntax with directives like allow and
options before aligning with the finalized
specification.
Once the W3C finalized the CSP specification, browsers
adopted the unprefixed Content-Security-Policy header.
The prefixed X-WebKit-CSP version persists in
production because some web frameworks and security
middleware still emit prefixed variants alongside the
standard header, usually one prefixed name rather
than both. Enterprise security policies and CMS platforms
continue sending the prefixed headers as a
defense-in-depth measure for older clients.
The header implemented CSP Level 1 directives:
default-src, script-src, style-src, img-src,
connect-src, object-src, media-src, font-src,
frame-src, report-uri, and sandbox. CSP Level 2
directives such as
frame-ancestors, base-uri, and form-action were
not part of the X-WebKit-CSP implementation.
Directives
The X-WebKit-CSP header accepts the same directive syntax as Content-Security-Policy. Common directives observed in production include:
default-src
The default-src directive sets the fallback policy for
all resource types not covered by a more specific
directive. A value of 'self' restricts loading to the
same origin.
script-src
The script-src directive controls which sources are
allowed to serve JavaScript. Values like 'self',
'unsafe-inline', and 'unsafe-eval' define the level
of restriction.
style-src
The style-src directive controls which sources are
allowed to serve stylesheets.
img-src
The img-src directive controls which sources are
allowed to serve images. A wildcard * permits images
from any origin.
frame-ancestors
The frame-ancestors directive limits which origins
embed the page, the second most common directive in
crawled values of this header even though the
directive arrived with CSP Level 2.
font-src
The font-src directive restricts origins for
@font-face loads.
object-src
The object-src directive restricts sources for
<object>, <embed>, and <applet> elements.
connect-src
The connect-src directive restricts the origins to
which scripts are allowed to connect via XHR,
WebSocket,
and fetch requests.
Example
A simple policy restricting all resources to the same
origin. The default-src 'self' directive blocks
loading from any external source.
X-WebKit-CSP: default-src 'self'
A stricter policy restricting object embedding and connections to the same origin, with images blocked from external sources.
X-WebKit-CSP: object-src 'self'; connect-src 'self'; img-src 'self'
A site pairing the standard header with prefixed
variants for maximum
backward compatibility. Modern browsers read the
standard Content-Security-Policy header. Older
WebKit-based browsers fall back to X-WebKit-CSP, and
legacy Firefox versions fall back to
X-Content-Security-Policy.
Content-Security-Policy: default-src 'self'; img-src *
X-WebKit-CSP: default-src 'self'; img-src *
X-Content-Security-Policy: default-src 'self'; img-src *