CSP: base-uri
The HTTP Content-Security-Policy base-uri directive restricts the URLs which can be used in a document's <base> element. If this value is absent, then any URI is allowed. If this directive is absent, the user agent will use the value in the <base> element.
| CSP version | 2 |
|---|---|
| Directive type | Document directive |
default-src fallback |
No. Not setting this allows any URL. |
Syntax
One or more sources can be allowed for the base-uri policy:
http
Content-Security-Policy: base-uri <source>;
Content-Security-Policy: base-uri <source> <source>;
Sources
This directive uses the same CSP Source Values syntax for arguments as other CSP directives. However, only values that match URLs make sense for base-uri, including <host-source>, <scheme-source>, 'self', and 'none'.
Examples
Meta tag configuration
html
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />
Apache configuration
apacheconf
<IfModule mod_headers.c>
Header set Content-Security-Policy "base-uri 'self'";
</IfModule>
Nginx configuration
nginx
add_header Content-Security-Policy "base-uri 'self';"
Violation case
Since your domain isn't example.com, a <base> element with its href set to https://example.com will result in a CSP violation.
html
<meta http-equiv="Content-Security-Policy" content="base-uri 'self'" />
<base href="https://example.com/" />
<!--
// Error: Refused to set the document's base URI to 'https://example.com/'
// because it violates the following Content Security Policy
// directive: "base-uri 'self'"
-->
Specifications
| Specification |
|---|
| Content Security Policy Level 3 # directive-base-uri |
Browser compatibility
BCD tables only load in the browser