---
schema_version: "1"
id: f9ae30cfadc961277dee3105883a604eb51358ccc9e5e24c889ca9cc35761870
title: Supported CSP Directives
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/commerce-cloud/commerce-api/guides/cdn-supported-csp-directives.md
canonical_url: https://developer.salesforce.com/docs/commerce/pwa-kit-managed-runtime/guide/cdn-supported-csp-directives.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 8d2d25a009cd1c8e95d8017815765b1457691c8f49fc7459d4de44c17fc10943
products:
  - Composable Storefront
  - Salesforce APIs
---
# Supported CSP Directives

| Directive    | Category | Supported special values | Alerting Enabled | Example usage |
| ------------ | -------- | ------------------------ | ---------------- | ------------- |
| `script-src` | Scripts  | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |Yes |`script-src stripe.com *.stripe.com ;` |
|`connect-src` |Connections | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul>` |Yes |`connect-src 'unsafe-inline' https://www.shop.stg.bcxg.sfcc-store-internal.net ;` |
|`default-src` |Default | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | `default-src *.js.stripe.com 'unsafe-eval' 'unsafe-inline' ;` |
|`img-src` |Images | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No |`img-src 'self' 'unsafe-inline' ;` |
|`style-src` |Styles | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`font-src` |Fonts | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`object-src` |Objects | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`media-src` |Media | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`child-src` |Child | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`form-action` |Form actions | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`worker-src` |Workers | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`base-uri` |Base URI | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`manifest-src` |Manifests | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`frame-src` |Frames | <ul><li>`'none'`</li><li>`'self'`</li><li>`'unsafe-inline'`</li><li>`'unsafe-eval'`</li><li>`'<HASH>'`</li></ul> |No | |
|`frame-ancestors` |Frame ancestors | <ul><li>`'none'`</li><li>`'self'`</li></ul> |No | |
|`upgrade-insecure-requests` |Upgrade insecure requests |N/A |No | |