# media-src (/en/docs/web-security/policies/content-security-policy/directives/media-src)



The `media-src` directive controls where media can load from under a Content Security Policy (CSP). It governs the `src` of `<audio>` and `<video>` elements and their `<source>` and `<track>` children, so it decides which origins your page can stream media from.

A minimal safe policy for this directive:

```http
Content-Security-Policy: media-src 'self' https://media.example.com
```

## Fallback chain [#fallback-chain]

`media-src` falls back to [`default-src`](/en/docs/web-security/policies/content-security-policy/directives/default-src). If you do not set `media-src`, media is governed by whatever `default-src` allows. If neither is present, media loads from anywhere.

## Values [#values]

`media-src` takes a space-separated source list combining [keyword sources](/en/docs/web-security/policies/content-security-policy/values/csp-keywords), [host sources](/en/docs/web-security/policies/content-security-policy/values/csp-host-source), and [scheme sources](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source):

| Value               | Status  | Description                                                                              |
| ------------------- | ------- | ---------------------------------------------------------------------------------------- |
| `'none'`            | ✅ Good  | Blocks all media loads.                                                                  |
| `'self'`            | ✅ Good  | Media from the page's own origin only.                                                   |
| `media.example.com` | ✅ Good  | A named media or streaming host.                                                         |
| `https:`            | ✅ Good  | Any HTTPS origin. Broad; prefer named hosts.                                             |
| `blob:`             | ✅ Good  | Client-generated media (Media Source Extensions, recorded streams).                      |
| `mediastream:`      | ✅ Good  | Live media streams. Niche, and relevant to `media-src` only.                             |
| `*`                 | ❌ Risky | Any host can receive media requests, a covert channel. Never matches `data:` or `blob:`. |

Nonces and hashes do not apply to media.

## Examples [#examples]

```http
Content-Security-Policy:
  default-src 'self';
  media-src 'self' https://media.example.com blob:
```

This allows media from your own origin, a named media host, and `blob:` URLs.

## Common use [#common-use]

`media-src` commonly needs `blob:` when you play media generated or buffered client-side, for example with Media Source Extensions, `URL.createObjectURL`, or recorded audio and video. A streaming player that builds its buffer in JavaScript will fail without `blob:` in `media-src`.

If you embed a third-party video *player* in an iframe, that is governed by [`frame-src`](/en/docs/web-security/policies/content-security-policy/directives/frame-src), not `media-src`. `media-src` only applies to media elements rendered directly on your page.

## Security notes [#security-notes]

Media is a low-risk resource type: it cannot execute, and a blocked media file degrades the page rather than breaking its logic. The directive limits where media streams come from, which matters mainly for content integrity and to avoid serving media from untrusted hosts. Check the overall policy with the [CSP evaluator](/tools/csp-evaluator).

## Known bypasses and risks [#known-bypasses-and-risks]

Because media cannot run code, `media-src` is a content control rather than an injection control. The main risk is an over-broad source list such as `media-src *`, which lets an injected media element request from any host as a covert channel. A wildcard `*` does not match `blob:`, so list `blob:` explicitly when you need client-generated media.

## Recommendation [#recommendation]

```http
Content-Security-Policy: media-src 'self' https://media.example.com
```

Scope `media-src` to your own origin plus the media host you stream from. Add `blob:` only when your player builds media client-side, for example through Media Source Extensions or `URL.createObjectURL`. Avoid `*`, which lets an injected media element request from any host.

## Reporting [#reporting]

When a media load is blocked, the browser sends a [csp-violation report](/en/docs/web-security/reporting-api/reports/csp-violation) with `media-src` as the `effectiveDirective`, including the blocked URL. CentralCSP collects and aggregates these reports, so you can see every media host your pages actually use before you tighten the directive.

## Browser support [#browser-support]

`media-src` is part of CSP Level 1 and is supported in every browser that implements CSP. It is stable and widely available.

## See also [#see-also]

* [Content Security Policy directives](/en/docs/web-security/policies/content-security-policy/introduction/csp-directives)
* [default-src](/en/docs/web-security/policies/content-security-policy/directives/default-src)
* [frame-src](/en/docs/web-security/policies/content-security-policy/directives/frame-src)
* [Scheme source values](/en/docs/web-security/policies/content-security-policy/values/csp-scheme-source)
* [CentralCSP CSP suite](/platform/csp-builder)

## Sources [#sources]

* [MDN, CSP media-src](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/media-src)
* [W3C, Content Security Policy Level 3](https://www.w3.org/TR/CSP3/)
* [W3C CSP editor's draft](https://w3c.github.io/webappsec-csp/)