| Initiator | Type | Destination | granular Initiator? | CSP directive | Features |
|---|---|---|---|---|---|
| "" | "" | "" | "" | ? | CSP, NEL reports. |
"document"
|
HTML's navigate algorithm. | ||||
"subresource"
|
""
|
connect-src
|
navigator.sendBeacon(), EventSource, HTML's ping=""
|
||
"unknown"
|
object
|
object-src
|
HTML's <object>
|
||
"unknown"
|
embed
|
object-src
|
HTML's <embed>
|
||
"audio"
|
"subresource"
|
audio
|
media-src
|
HTML's <audio>
|
|
"font"
|
"subresource"
|
font
|
font-src
|
CSS' @font-face
|
|
"image"
|
"subresource"
|
image
|
img-src
|
HTML's <img src>, /favicon.ico resource, SVG's <image>, CSS' background-image, CSS'
cursor, CSS' list-style-image, …
|
|
"script"
|
"subresource"
|
script
|
script-src
|
HTML's <script>, importScripts()
|
|
"serviceworker"
|
script
|
? | navigator.serviceWorker.register()
|
||
"sharedworker"
|
script
|
child-src
|
SharedWorker
|
||
"script"
|
script
|
child-src
|
Worker
|
||
"style"
|
"subresource"
|
style
|
style-src
|
HTML's <link rel=stylesheet>, CSS' @import
|
|
"track"
|
"subresource"
|
track
|
media-src
|
HTML's <track>
|
|
"video"
|
"subresource"
|
video
|
media-src
|
HTML's <video> element
|
|
"download"
|
"" | "" | download
|
? | HTML's download="", "Save Link As…" UI
|
"fetch"
|
"" | "subresource"
|
fetch
|
connect-src
|
fetch(), Cache API?, XMLHttpRequest
|
"imageset"
|
"image"
|
"subresource"
|
image
|
img-src
|
HTML's <img srcset> and <picture>
|
"manifest"
|
"" | "subresource"
|
manifest
|
manifest-src
|
HTML's <link rel=manifest>
|
"xslt"
|
"script"
|
"subresource"
|
script
|
script-src
|
<?xml-stylesheet>
|
?
|
"?"
|
"?"
|
?
|
child-src
|
HTML's <iframe>, <frame>
|