CSP: block-all-mixed-content

Relawan kami belum menerjemahkan artikel ini ke bahasa Bahasa Indonesia. Bergabunglah dan bantu kami menyelesaikannya!
Anda juga dapat membaca artikel ini dalam English (US).

The HTTP Content-Security-Policy (CSP) block-all-mixed-content directive prevents loading any assets using HTTP when the page is loaded using HTTPS.

All mixed content resource requests are blocked, including both active and passive mixed content. This also applies to <iframe> documents, ensuring the entire page is mixed content free.

The upgrade-insecure-requests directive is evaluated before block-all-mixed-content and If the former is set, the latter is effectively a no-op. It is recommended to set one directive or the other – not both.

Syntax

Content-Security-Policy: block-all-mixed-content;

Examples

Content-Security-Policy: block-all-mixed-content;

<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">

To disallow http assets on a more granular level, you can also set individual directives to "https:". For example, to disallow insecure http images:

Content-Security-Policy: img-src https:

Specifications

Specification Status Comment
Mixed Content
The definition of 'block-all-mixed-content' in that specification.
Candidate Recommendation Initial definition.

Browser compatibility

FeatureChromeEdgeFirefoxInternet ExplorerOperaSafari
Basic support Yes ?48 No Yes ?
FeatureAndroid webviewChrome for AndroidEdge mobileFirefox for AndroidOpera AndroidiOS SafariSamsung Internet
Basic support Yes Yes ?48 ? ? Yes

See also

Tag Dokumen dan Kontributor

Kontributor untuk laman ini: fscholz, teoli
Terakhir diperbarui oleh: fscholz,