CSP: base-uri

Baseline Widely available

This feature is well established and works across many devices and browser versions. It’s been available across browsers since August 2016.

The HTTP Content-Security-Policy base-uri directive restricts the URLs which can be used in a document's <base> element. If this value is absent, then any URI is allowed. If this directive is absent, the user agent will use the value in the <base> element.

CSP version 2
Directive type Document directive
default-src fallback No. Not setting this allows any URL.

Syntax

http
Content-Security-Policy: base-uri 'none';
Content-Security-Policy: base-uri <source-expression-list>;

This directive may have one of the following values:

'none'

No base URI may be set using a <base> element. The single quotes are mandatory.

<source-expression-list>

A space-separated list of source expression values. A <base> element may set a base URI if its value matches any of the given source expressions. For this directive, the following source expression values are applicable:

Examples

Meta tag configuration

html
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />

Apache configuration

apacheconf
<IfModule mod_headers.c>
Header set Content-Security-Policy "base-uri 'self'";
</IfModule>

Nginx configuration

nginx
add_header Content-Security-Policy "base-uri 'self';"

Violation case

Since your domain isn't example.com, a <base> element with its href set to https://example.com will result in a CSP violation.

html
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />
<base href="https://example.com/" />

<!--
// Error: Refused to set the document's base URI to 'https://example.com/'
// because it violates the following Content Security Policy
// directive: "base-uri 'self'"
-->

Specifications

Specification
Content Security Policy Level 3
# directive-base-uri

Browser compatibility

Report problems with this compatibility data on GitHub
desktopmobile
Chrome
Edge
Firefox
Opera
Safari
Chrome Android
Firefox for Android
Opera Android
Safari on iOS
Samsung Internet
WebView Android
WebView on iOS
base-uri

Legend

Tip: you can click/tap on a cell for more information.

Full support
Full support

See also