plugin-types
The CSP plugin-types directive once limited the MIME types of embedded plugins. It is deprecated and removed. Use object-src none instead.
Last update:
The plugin-types Content Security Policy (CSP) directive once restricted the set
of MIME types a page could load through plugin elements such as <object> and
<embed>. Browser plugins have been retired, so the directive was dropped from
the specification and removed from browsers.
Deprecated
plugin-types is deprecated and has been removed. Browsers retired plugin support entirely, which left the directive nothing to govern, so it was dropped from CSP Level 3 and removed from Chromium. To block plugin content, set object-src 'none' instead.
Use the replacement instead:
Content-Security-Policy: object-src 'none'What you should do instead
Use object-src
to control plugin content. Setting it to 'none', as in the example above,
blocks <object>, <embed>, and the legacy <applet> outright, which is the
recommended strict-CSP default and covers what plugin-types was meant to
restrict.
This is more direct than allowlisting MIME types: there is no longer a reason to permit any plugin type on the modern web, so block them all.
Why it was removed
plugin-types existed to allowlist plugin MIME types back when browsers ran NPAPI
and similar plugins. Browsers have since removed plugin support entirely, so a
directive that allowlisted plugin types had nothing left to govern. CSP Level 3
dropped it, and Chromium removed it.
Browser support
No current browser enforces plugin-types. It was removed from Chromium and was
never part of CSP Level 3. Use
object-src 'none'
in its place.
See also
- object-src, the directive to use instead
- default-src, the fallback that object-src defers to
- Evaluate a policy with the CSP evaluator