object-src directive, block object and embed in CSP

The CSP object-src directive controls object and embed plugin content. Setting object-src none is a core part of a strict CSP.

The object-src directive controls plugin content under a Content Security Policy (CSP). It governs <object> and <embed> elements, which can load plugins, Flash, PDFs, and other embedded content that historically ran in the page's context.

A minimal safe policy for this directive:

Content-Security-Policy: object-src 'none'

Fallback chain

object-src falls back to default-src. If you do not set object-src, plugin content is governed by whatever default-src allows. If neither is present, it loads from anywhere.

Values

object-src takes a space-separated source list combining keyword sources, host sources, and scheme sources:

Value	Status	Description
`'none'`	✅ Good	Blocks all plugin content. The recommended value.
`'self'`	✅ Good	Same-origin plugin content only. Prefer `'none'` unless you embed something.
`plugins.example.com`	✅ Good	The exact host of a resource you must embed.
`https:`	❌ Risky	Plugin content from any HTTPS host; re-opens the injection sink.
`data:`	❌ Risky	An attacker-controlled `data:` URL can carry active plugin content that executes.
`blob:`	❌ Risky	Lets injected script construct plugin content client-side.
`*`	❌ Risky	No protection at all for this sink. Never matches `data:` or `blob:`.

Nonces and hashes do not apply.

Examples

Content-Security-Policy:
  default-src 'self';
  object-src 'none';
  base-uri 'none'

Here plugin content is blocked entirely, which is the recommended setting for almost every site.

Common use

The standard value is object-src 'none'. Plugin embeds are an injection sink: an attacker who can place an <object> or <embed> element can sometimes load active content that executes in the page. Because modern browsers have dropped plugin support and <embed>/<object> are rarely needed, blocking them outright costs nothing on most sites and closes a real attack surface. object-src 'none' is one of the directives a strict CSP always includes, alongside a nonce or hash on script-src and base-uri 'none'.

The now-removed plugin-types directive used to restrict plugin MIME types. It has been dropped from CSP Level 3 and from browsers; use object-src 'none' instead. You can confirm a strict policy includes it with the CSP evaluator.

Security notes

Unlike images or fonts, plugin content can carry executable behavior, so object-src is a genuine injection control, not just a content control. There is rarely a reason to allow it. If you must embed a specific plugin resource, scope object-src to the exact host rather than relaxing it broadly.

Known bypasses and risks

Leaving object-src unset (and relying on a permissive default-src) leaves the plugin sink open, which is why strict-CSP guidance names object-src 'none' explicitly. Any value broader than the specific hosts you actually embed re-opens the sink. A wildcard object-src * is effectively no protection at all for this resource type.

Recommendation

Content-Security-Policy: object-src 'none'

Block plugin content entirely. object-src 'none' is part of the strict policy recommended by the OWASP CSP cheat sheet and web.dev's strict CSP guidance. Modern sites almost never need <object> or <embed>, so this closes an injection sink at no cost.

Reporting

When plugin content is blocked, the browser sends a csp-violation report with object-src as the effectiveDirective, including the blocked URL. CentralCSP collects and aggregates these reports, so an unexpected object-src violation surfaces immediately, which usually means injected markup.

Browser support

object-src is part of CSP Level 1 and is supported in every browser that implements CSP. It is stable and widely available.

FAQ

Why set object-src to none?

<object> and <embed> are an injection sink: an attacker who places one can sometimes load active content that executes in the page. Modern browsers have dropped plugin support, so object-src 'none' closes that surface at no cost and is one directive every strict CSP includes.

What does object-src control?

object-src governs plugin content loaded through <object> and <embed> elements, historically Flash, PDFs, and other embedded content that ran in the page's context. It does not accept nonces or hashes. If you do not set it, plugin content falls back to default-src.

object-src