In CSP2, the `'self'` source expression explicitly excludes `blob:` and `filesystem:`. This means that developers will need to add those schemes explicitly to their directives if they wish to include content at those URLs.


Established standard

Status in Chromium


Enabled by default (tracking bug) in:

  • Chrome for desktop release 45
  • Chrome for Android release 45
  • Android WebView release 45

Consensus & Standardization

After a feature ships in Chrome, the values listed here are not guaranteed to be up to date.

  • Positive
  • No signal
  • No signal
  • No signals


Last updated on 2020-11-09