Skip to content
Header Hawk

media-src

media-src specifies valid sources for <audio>, <video> and <track>.

The catch on a media-heavy site is that adaptive players do not load the URL you wrote. They fetch segments over connect-src and hand the element a blob: URL, so a working policy usually needs blob: here and the segment host in connect-src.

Syntax

Section titled “Syntax”
Content-Security-Policy: media-src 'none';
Content-Security-Policy: media-src <source-expression-list>;

What it controls

Section titled “What it controls”
  • <audio> sources.
  • <video> sources.
  • <track> sources, including subtitle and caption files.

Fallback

Section titled “Fallback”

If media-src is absent, the browser consults default-src. The full chain is media-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: media-src 'self' blob:
  • blob: is what Media Source Extensions hands the element, and it is not covered by 'self'.
  • If you embed a hosted player, the media origin goes here and the player’s iframe origin goes in frame-src - they are different directives and usually different hosts.

Examples

Section titled “Examples”

Allowed

Section titled “Allowed”

A same-origin file and an MSE stream, under media-src 'self' blob::

<video src="/media/intro.mp4"></video>

Blocked

Section titled “Blocked”

Under media-src 'self':

<video src="https://cdn.video.example/stream.m3u8"></video>

Browser support

Section titled “Browser support”
  • Widely available across browsers since August 2016.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective media-src
effectiveDirective media-src
blockedUri https://cdn.video.example/stream.m3u8, blob
Issue title media-src blocking cdn.video.example
  • blockedUri: "blob" groups as a single media-src blob: URI issue. Seeing it means a player is constructing object URLs, not that a specific file was refused - allow blob: rather than hunting for the URL.
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.