Skip to content

Commit

Permalink
Allowing Inline Speculation Rules with CSP (mdn#34897)
Browse files Browse the repository at this point in the history
  • Loading branch information
gapple authored Sep 16, 2024
1 parent 2e43357 commit bca6332
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion files/en-us/web/api/speculation_rules_api/index.md
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ A script example:
</script>
```

Speculation rules using a `<script>` element need to be explicitly allowed in the {{httpheader("Content-Security-Policy")}} [`script-src`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src) directive if the site includes it. This is done by adding the `'inline-speculation-rules'` source along with a hash- or nonce-source.
Speculation rules using a `<script>` element need to be explicitly allowed in the {{httpheader("Content-Security-Policy")}} [`script-src`](/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src) directive if the site includes it. This is done by adding one of the `'inline-speculation-rules'` source, a hash-source, or nonce-source.

An HTTP header example:

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -263,10 +263,10 @@ will act like `'unsafe-inline' https:` in browsers that support CSP1, `https: 'n

### Allowing speculation rules

To include [speculation rules](/en-US/docs/Web/API/Speculation_Rules_API) in scripts (see also [`<script type="speculationrules">`](/en-US/docs/Web/HTML/Element/script/type/speculationrules)), you need to use the `script-src` directive along with the `'inline-speculation-rules'` source and a hash- or nonce-source. For example:
To include [speculation rules](/en-US/docs/Web/API/Speculation_Rules_API) in a script element (see also [`<script type="speculationrules">`](/en-US/docs/Web/HTML/Element/script/type/speculationrules)), you need to use the `script-src` directive with one of the `'inline-speculation-rules'` source, a hash-source, or nonce-source. For example:

```http
Content-Security-Policy: script-src 'inline-speculation-rules' 'sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC'
Content-Security-Policy: script-src 'inline-speculation-rules'
```

## Specifications
Expand Down

0 comments on commit bca6332

Please sign in to comment.