fenced-frame-src

The fenced-frame-src Content Security Policy (CSP) directive controls which sources may be loaded into a <fencedframe> element. A fenced frame is an embedded context that is isolated from the page that hosts it, used by privacy-focused APIs such as Protected Audience and Shared Storage.

A minimal policy for this directive, with the tightest value it accepts:

Content-Security-Policy: fenced-frame-src https:

Fallback chain

When fenced-frame-src is absent, the browser falls back to frame-src, and then to child-src:

fenced-frame-src -> frame-src -> child-src

So a policy that already constrains frame-src also constrains fenced frames unless you set fenced-frame-src to a different value.

Values

fenced-frame-src accepts a restricted source list. Unlike other fetch directives, it only accepts the https: scheme source and the wildcard *:

Host sources, 'self', 'none', and nonce or hash sources are not accepted by this directive.

Examples

A policy that pins ordinary frames to the page's own origin while still allowing fenced frames, which cannot be pinned tighter than https::

Content-Security-Policy: frame-src 'self'; fenced-frame-src https:

Using * instead of https: is equivalent for this directive, since a fenced frame must be served over HTTPS regardless.

Security notes

A fenced frame is already strongly isolated from the embedding page by design. fenced-frame-src lets a policy state, at the document level, whether fenced frames may be created at all and from which scheme, so a page that does not use the relevant APIs can decline them through its CSP.

Known bypasses and risks

Because the directive only accepts https: and *, it cannot restrict fenced frames to a specific host the way frame-src restricts ordinary frames. The feature is tied to evolving privacy APIs, so its exact behavior and the directive grammar can change between Chromium releases.

Recommendation

Content-Security-Policy: fenced-frame-src https:

Set fenced-frame-src only if your page actually uses fenced frames; https: is the tightest value it accepts. If you do not use them, add nothing, a tight frame-src already covers fenced frames through the fallback chain. Either way, keep frame-src as the real restriction, since this directive cannot pin hosts and only runs in Chromium.

Reporting

When a fenced frame is blocked in a supporting browser, it sends a csp-violation report with fenced-frame-src as the effectiveDirective. CentralCSP collects and aggregates these reports alongside the rest of your CSP traffic, so you can watch this experimental surface without extra setup.

Browser support

Chromium-based browsers only (Chrome, Edge, and Opera), and still experimental. Not implemented in Firefox or Safari, and not part of Baseline. Browsers that do not implement fenced frames ignore the directive.

See also

• frame-src, the fallback and the directive for ordinary frames
• child-src, the next fallback in the chain
• Evaluate a policy with the CSP evaluator

Sources

• MDN, CSP fenced-frame-src
• W3C, Content Security Policy Level 3