The HTTP Content-Security-Policy
(CSP) block-all-mixed-content
directive prevents loading any assets using HTTP when the page is loaded using HTTPS.
All mixed content resource requests are blocked, including both active and passive mixed content. This also applies to <iframe>
documents, ensuring the entire page is mixed content free.
The upgrade-insecure-requests
directive is evaluated before block-all-mixed-content
and If the former is set, the latter is effectively a no-op. It is recommended to set one directive or the other – not both.
Syntax
Content-Security-Policy: block-all-mixed-content;
Examples
Content-Security-Policy: block-all-mixed-content; <meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">
To disallow http assets on a more granular level, you can also set individual directives to "https:". For example, to disallow insecure http images:
Content-Security-Policy: img-src https:
Specifications
Specification | Status | Comment |
---|---|---|
Mixed Content The definition of 'block-all-mixed-content' in that specification. |
Candidate Recommendation | Initial definition. |
Browser compatibility
The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.
Feature | Chrome | Firefox | Edge | Internet Explorer | Opera | Safari |
---|---|---|---|---|---|---|
Basic Support | (Yes) | 48.0 | ? | (No) | (Yes) | ? |
Feature | Android | Chrome for Android | Edge mobile | Firefox for Android | IE mobile | Opera Android | iOS Safari |
---|---|---|---|---|---|---|---|
Basic Support | ? | (Yes) | ? | 48.0 | (No) | ? | ? |