How to use frame-src and child-src in Firefox and other browsers?

firefox content-security-policy
ChrisD picture ChrisD · May 4, 2015 · Viewed 15k times · Source

The MDN page on Content Security Policy directives states the frame-src is deprecated and child-src should be used. However, Firefox 37 gives the following error message when I attempt to use child-src

Content Security Policy: Couldn't process unknown directive 'child-src' <unknown>

This apparent lack of support isn't documented (as far as I could tell) which is frustrating. Is there any place browser support is documented?

Currently I'm using frame-src in addition to child-src, which appears to work. However I'm now wondering if there is any potential for conflict between the two. Presumably frame-src will be ignored by browsers that support child-src? Is that guaranteed?

Answer

anthonyryan1 picture anthonyryan1 · May 26, 2015

Update: Jan 2017:

Stop using child-src and begin using frame-src again.

In an effort to create even more confusion, CSP Level 3 has undeprecated frame-src and actually re-appointed it as the preferred way to achieve this. While child-src is still supported frame-src is once again preferred.

Old post

frame-src is deprecated, but it was only recently made so in CSP Level 2 and not all browsers are up to the latest version of the spec.

The best approach at the moment for maximum browser compatibility is to include both child-src and frame-src with identical values. Browsers that only support the original CSP specification will use frame-src while newer ones will use child-src.

That developer console warning is of no consequence and merely informational. I would suggest you ignore it for now, because a year from now you may very well see one saying that frame-src is deprecated.

At this time, I ensure both are used when this is needed and intend to stop providing frame-src in January of 2017.

CSP Level 2 support:

  • Firefox - Pending
  • Chrome - 40+
  • Opera - 27+
  • Microsoft Edge - Pending
  • Safari - 10+

Related questions

CSP: How to allow unsafe-eval for a given URI prefix (Firefox)

I'm trying to use MathJax as part of our web application which uses pretty strict Content Security Policy (CSP). The problem is that MathJax is coded to use eval() [to be exact, in form of Function()] which is not considered …

Read More
X-Frame-Options and Content-Security-Policy for frames in Firefox

Content Security Policy specification says The frame-ancestors directive obsoletes the X-Frame-Options header. If a resource has both policies, the frame-ancestors policy SHOULD be enforced and the X-Frame-Options policy SHOULD be ignored. So from my understanding if both Content-Security-Policy and X-Frame-Options …

Read More
Content Security Policy: Couldn't parse invalid source chrome-extension

I'm getting a new error in my JS console on Firefox and I haven't changed the code. I don't get this error in other browsers and doesn't seem to affect the functionality of my code. It's obviously in some way …

Read More