prefetch-src
The CSP prefetch-src directive once controlled sources for prefetched and prerendered resources. It is deprecated, non-standard, and removed.
Last update:
The prefetch-src Content Security Policy (CSP) directive was intended to control
the sources a page could prefetch or prerender. It was only ever shipped in
Chromium, never standardized, and has since been removed.
Deprecated
prefetch-src is deprecated and non-standard. It was never part of the CSP specification, shipped only in Chromium, and has been removed: rather than standardize a separate directive, the platform governs speculative loads through the existing fetch directives. There is no replacement directive. Remove it from your policy; it has no effect in current browsers.
What you should do instead
There is no successor directive for prefetch and prerender sources. Prefetched and
prerendered resources are governed by the directive that matches the resource type
once it loads (for example
script-src
for scripts or img-src for images), and by Speculation Rules where they apply.
Delete prefetch-src from any policy that still carries it. Keeping it does no
harm beyond noise, but it controls nothing.
A policy needs no prefetch-specific directive; the ordinary fetch directives already govern each prefetched resource when it loads:
Content-Security-Policy: script-src 'self'; img-src 'self'Why it was removed
prefetch-src was a Chromium-only addition that never reached the CSP
specification or other browser engines. Rather than standardize a separate
directive, the platform settled on governing speculative loads through the
existing fetch directives, so prefetch-src was dropped.
Browser support
No current browser enforces prefetch-src. It was present in older Chromium
versions only and has been removed. Firefox and Safari never implemented it.
See also
- script-src, which governs prefetched scripts once they load
- default-src, the fallback for fetch directives
- Evaluate a policy with the CSP evaluator