CSP: base-uri
HTTP 协议 Content-Security-Policy
首部字段中的 base-uri
指令限制了可以应用于一个文档的 <base>
元素的 URL。假如指令值为空,那么任何 URL 都是允许的。如果指令不存在,那么用户代理会使用 <base>
元素中的值。
CSP version | 2 |
---|---|
Directive type | Document directive |
default-src fallback |
No. Not setting this allows anything. |
语法
base-uri 安全策略可以设置一个或多个源:
Content-Security-Policy: base-uri <source>; Content-Security-Policy: base-uri <source> <source>;
源
<source>
can be any one of the values listed in CSP Source Values.
Note that this same set of values can be used in all fetch directives (and a number of other directives).
示例
Meta tag 配置
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'">
Apache 配置
<IfModule mod_headers.c>
Header set Content-Security-Policy "base-uri 'self';
</IfModule>
Nginx 配置
add_header Content-Security-Policy "base-uri 'self';"
违犯策略的案例
假如你的域名不是 example.com,那么将 <base>
元素的 href 属性值设置成 example.com 会违犯 CSP 策略。
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'">
<base href="http://example.com/">
// Error: Refused to set the document's base URI to 'http://example.com/'
// because it violates the following Content Security Policy
// directive: "base-uri 'self'"
规范
Specification | Status | Comment |
---|---|---|
Content Security Policy Level 3 base-uri |
Working Draft | No changes. |
Content Security Policy Level 2 base-uri |
Recommendation | Initial definition. |
浏览器兼容性
No compatibility data found for http.headers.csp.base-uri
.
Check for problems with this page or contribute missing data to mdn/browser-compat-data.