media-src directive, control audio and video sources

The CSP media-src directive controls where audio, video, and track resources can load from on the page.

The media-src directive controls where media can load from under a Content Security Policy (CSP). It governs the src of <audio> and <video> elements and their <source> and <track> children, so it decides which origins your page can stream media from.

A minimal safe policy for this directive:

Content-Security-Policy: media-src 'self' https://media.example.com

Fallback chain

media-src falls back to default-src. If you do not set media-src, media is governed by whatever default-src allows. If neither is present, media loads from anywhere.

Values

media-src takes a space-separated source list combining keyword sources, host sources, and scheme sources:

Value	Status	Description
`'none'`	✅ Good	Blocks all media loads.
`'self'`	✅ Good	Media from the page's own origin only.
`media.example.com`	✅ Good	A named media or streaming host.
`https:`	✅ Good	Any HTTPS origin. Broad; prefer named hosts.
`blob:`	✅ Good	Client-generated media (Media Source Extensions, recorded streams).
`mediastream:`	✅ Good	Live media streams. Niche, and relevant to `media-src` only.
`*`	❌ Risky	Any host can receive media requests, a covert channel. Never matches `data:` or `blob:`.

Nonces and hashes do not apply to media.

Examples

Content-Security-Policy:
  default-src 'self';
  media-src 'self' https://media.example.com blob:

This allows media from your own origin, a named media host, and blob: URLs.

Common use

media-src commonly needs blob: when you play media generated or buffered client-side, for example with Media Source Extensions, URL.createObjectURL, or recorded audio and video. A streaming player that builds its buffer in JavaScript will fail without blob: in media-src.

If you embed a third-party video player in an iframe, that is governed by frame-src, not media-src. media-src only applies to media elements rendered directly on your page.

Security notes

Media is a low-risk resource type: it cannot execute, and a blocked media file degrades the page rather than breaking its logic. The directive limits where media streams come from, which matters mainly for content integrity and to avoid serving media from untrusted hosts. Check the overall policy with the CSP evaluator.

Known bypasses and risks

Because media cannot run code, media-src is a content control rather than an injection control. The main risk is an over-broad source list such as media-src *, which lets an injected media element request from any host as a covert channel. A wildcard * does not match blob:, so list blob: explicitly when you need client-generated media.

Recommendation

Content-Security-Policy: media-src 'self' https://media.example.com

Scope media-src to your own origin plus the media host you stream from. Add blob: only when your player builds media client-side, for example through Media Source Extensions or URL.createObjectURL. Avoid *, which lets an injected media element request from any host.

Reporting

When a media load is blocked, the browser sends a csp-violation report with media-src as the effectiveDirective, including the blocked URL. CentralCSP collects and aggregates these reports, so you can see every media host your pages actually use before you tighten the directive.

Browser support

media-src is part of CSP Level 1 and is supported in every browser that implements CSP. It is stable and widely available.

media-src