navigate-to
The CSP navigate-to directive would have restricted navigation targets. It was removed from the spec in 2022 and never shipped in any browser.
Last update:
The navigate-to Content Security Policy (CSP) directive would have restricted
the targets a page could navigate to, through links, form submissions, and
script-driven navigation. It was removed from the CSP specification in September
2022 and never shipped in any browser.
Removed
navigate-to was removed from the CSP specification in September 2022 because the working group never settled how it should handle redirects and cross-origin navigation. It only ever existed behind development flags in Chrome and Firefox and never shipped to users. There is no replacement. Remove it from your policy; it has no effect in any browser.
What you should do instead
There is no replacement for restricting navigation targets in general. The
closest surviving control is
form-action,
which restricts where forms may submit, but nothing in CSP governs where a link
or a script may navigate the page. Delete navigate-to from any policy that
carries it. Its companion keyword 'unsafe-allow-redirects' remains in the spec
grammar with no functional definition, so it should go too; see the
CSP keyword values
page for the keywords that do work.
Why it was removed
navigate-to raised unresolved questions about redirects and cross-origin
navigation that the working group never settled, so the directive was dropped
from the specification in September 2022. It had only ever been implemented
behind development flags in Chrome and Firefox and never reached users in
either browser.
Browser support
No browser supports navigate-to. It existed only behind development flags in
Chrome and Firefox and never shipped. Safari never implemented it.
See also
- form-action, the surviving navigation-adjacent directive
- Directives index
- Evaluate a policy with the CSP evaluator