32

The MDN page on Content Security Policy directives states the frame-src is deprecated and child-src should be used. However, Firefox 37 gives the following error message when I attempt to use child-src

Content Security Policy: Couldn't process unknown directive 'child-src' <unknown>

This apparent lack of support isn't documented (as far as I could tell) which is frustrating. Is there any place browser support is documented?

Currently I'm using frame-src in addition to child-src, which appears to work. However I'm now wondering if there is any potential for conflict between the two. Presumably frame-src will be ignored by browsers that support child-src? Is that guaranteed?

1 Answer 1

51

Update: Jan 2017:

Stop using child-src and begin using frame-src again.

In an effort to create even more confusion, CSP Level 3 has undeprecated frame-src and actually re-appointed it as the preferred way to achieve this. While child-src is still supported frame-src is once again preferred.


Old post

frame-src is deprecated, but it was only recently made so in CSP Level 2 and not all browsers are up to the latest version of the spec.

The best approach at the moment for maximum browser compatibility is to include both child-src and frame-src with identical values. Browsers that only support the original CSP specification will use frame-src while newer ones will use child-src.

That developer console warning is of no consequence and merely informational. I would suggest you ignore it for now, because a year from now you may very well see one saying that frame-src is deprecated.

At this time, I ensure both are used when this is needed and intend to stop providing frame-src in January of 2017.

CSP Level 2 support:

  • Firefox - Pending
  • Chrome - 40+
  • Opera - 27+
  • Microsoft Edge - Pending
  • Safari - 10+
2
  • See also: bugzilla.mozilla.org/show_bug.cgi?id=1288896 - in practice you may need both frame-src and child-src and the fact that Firefox emits that warning is just a bug. Mar 22, 2017 at 13:51
  • 1
    Rabbit hole alert - I started getting these warnings in my application, however, the warnings don't give context to what spawned them. Through trial and error, in my application it was a 3rd-party script from intercom.io.
    – png
    Mar 27, 2018 at 23:19

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.