Skip to content
Header Hawk

child-src

child-src covers both nested browsing contexts (<frame>, <iframe>) and workers. CSP Level 3 split those responsibilities into frame-src and worker-src, and left child-src as the fallback behind both.

There is almost no reason to set it in a new policy. It is worth understanding because it is why a policy with no worker-src can still block a worker.

Syntax

Section titled “Syntax”
Content-Security-Policy: child-src 'none';
Content-Security-Policy: child-src <source-expression-list>;

What it controls

Section titled “What it controls”
  • <frame> and <iframe> loads, when frame-src is absent.
  • Worker, SharedWorker and ServiceWorker scripts, when worker-src is absent.

Fallback

Section titled “Fallback”

If child-src is absent, the browser consults default-src. The full chain is child-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: frame-src 'none'; worker-src 'self'
  • Write the two specific directives instead. They say what you mean, and a reader of the policy does not have to work out which half of child-src was intended.
  • Keep an existing child-src in place if older browsers matter to you - it is the fallback that catches them - but do not add one to a new policy.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

Under child-src 'self', both an iframe and a worker from the same origin:

new Worker("/workers/parse.js");

Blocked

Section titled “Blocked”

Under child-src 'self', with no worker-src to override it:

new Worker("https://cdn.example.com/worker.js");

Browser support

Section titled “Browser support”
  • Widely available across browsers since April 2017.
  • worker-src falls back to child-src before script-src, so a child-src rule wins over a script-src rule for workers.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective child-src
effectiveDirective child-src
blockedUri https://cdn.example.com/worker.js, blob
Issue title child-src blocking cdn.example.com
  • A child-src issue in HeaderHawk means no more specific directive applied. If it is about an iframe, adding frame-src moves the reports there; if it is about a worker, worker-src does.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.