About
A Content Security Policy (CSP) uses directives to control which resources a page can load and how other sites can use the page. Most directives list sources, such as domains or special values.
Here are the directives and source values you might see in a policy for your Content Hubs or legacy Video Portal site, or for a Kaltura Application Framework (KAF) integration.
To generate, test, and apply a policy, see Configure a Content Security Policy (CSP).
Directives
Your policy is made up of directives, such as script-src and img-src. Most directives control one type of content. Others control framing or base addresses.
The table below explains directives you might see in your policy or need to add. The generated policy doesn't necessarily include every directive your site needs. For example, it doesn't include connect-src.
| Directive | What it controls |
|---|---|
default-src |
Provides a fallback rule for resource types, such as scripts, images, fonts, and connections, that don't have their own directive in the policy. It doesn't apply to directives that control other things, such as base-uri and frame-ancestors. |
script-src |
Controls which scripts the browser can run. |
style-src |
Controls stylesheets and inline styles. |
img-src |
Controls images, such as thumbnails and logos. |
font-src |
Controls fonts. |
connect-src |
Controls browser connections to APIs, analytics services, and other endpoints. |
media-src |
Controls audio and video sources. |
worker-src |
Controls scripts that run in the background, separately from the page. |
frame-src |
Controls what your pages can load in frames, such as YouTube videos. Compare with frame-ancestors. |
frame-ancestors |
Controls which websites can load your pages in a frame. Compare with frame-src. |
base-uri |
Controls which addresses a page can use as its base address. |
object-src |
Controls plugins and other embedded objects. The generated policy sets this to 'none'. |
Sources
Each directive lists the sources that the browser can use. A source can be your own site, a specific domain, a group of subdomains, a URL scheme such as blob:, or a special value such as 'none'.
The table below explains the sources you might see in your policy.
| Value | Meaning |
|---|---|
'self' |
Allows resources from the same origin as the page, that is, the same scheme, domain, and port. It doesn't include other domains or subdomains, such as other Kaltura domains. |
'none' |
Prevents the resource type from loading from any source. |
https://example.com |
Allows resources from one specific HTTPS domain. |
https://*.example.com |
Allows resources from all subdomains of the specified domain, but not from the domain itself. For example, https://*.example.com doesn't include https://example.com. |
https: |
Allows resources from any domain over HTTPS. |
blob: |
Allows resources that the browser creates in memory, such as media data the player prepares during playback. This is a URL scheme, not a domain. Add it only to the directive that needs it. |
data: |
Allows resources that are included directly in the page, such as small images. This is a URL scheme, not a domain. Add it only to the directive that needs it. |
kaltura-pc: |
Allows your site to open the Kaltura Capture app. The generated policy includes this value in frame-src if Kaltura Capture is enabled on your site. |
'unsafe-inline' |
Allows inline scripts or styles, depending on the directive it's in, such as script-src or style-src. If the same directive includes a nonce, browsers ignore 'unsafe-inline'. This value reduces the protection the policy gives. The generated policy includes this value if Theming isn't enabled on your site. Pages that don't use Theming need it, even on a site where Theming is enabled. Don't add or remove it unless Kaltura Support or your security team confirms that it's needed. |
'unsafe-eval' |
Allows dynamic code evaluation. This reduces the protection the policy gives. The generated policy includes this value if Theming isn't enabled on your site. Pages that don't use Theming need it, even on a site where Theming is enabled. Don't add or remove it unless Kaltura Support or your security team confirms that it's needed. |
'nonce-...' |
Allows inline scripts or styles that have the matching nonce. It doesn't allow other inline code, such as inline event handlers. The generated policy includes 'nonce-{{scriptNonce}}' and 'nonce-{{styleNonce}}' if Theming is enabled on your site. Each time a page loads, Kaltura replaces these tokens with a new one-time value. Keep them in your policy as they are. On pages that don't use Theming, such as the media page or the editor on some sites, nonce tokens can stop inline code from working. If that happens, contact Kaltura Support. |
CSP applies to resources and connections made by the browser. If your site connects directly to an API from the browser, add the endpoint to the directive for that type of request. For API connections, this is usually connect-src. Server-to-server API calls aren't affected by CSP.
