Skip to content
Header Hawk

object-src

object-src specifies valid sources for <object> and <embed>.

These are legacy elements that receive no new security features - no sandbox, no allow. MDN’s own advice is to restrict the directive, and in practice that means object-src 'none' on every policy, in the same breath as base-uri 'self'.

Syntax

Section titled “Syntax”
Content-Security-Policy: object-src 'none';
Content-Security-Policy: object-src <source-expression-list>;

What it controls

Section titled “What it controls”
  • <object> and <embed> content.

Fallback

Section titled “Fallback”

If object-src is absent, the browser consults default-src. The full chain is object-src → default-src.

Section titled “Recommended value”
Content-Security-Policy: object-src 'none'
  • Nothing on a modern site needs plugin content, and the elements cannot be sandboxed. 'none' costs nothing and closes a real bypass: an attacker who can inject an <object> can sometimes execute script through it even under a strict script-src.
  • Setting it explicitly matters even when default-src 'none' would already cover it, because the moment someone relaxes default-src the plugin hole reopens silently.

Examples

Section titled “Examples”

Blocked

Section titled “Blocked”

Under object-src 'none', both are refused:

<object data="/legacy/report.pdf" type="application/pdf"></object>
<embed src="https://widget.vendor.example/player.swf" />

Browser support

Section titled “Browser support”
  • Widely available across browsers since August 2016.

In a HeaderHawk report

Section titled “In a HeaderHawk report”
Field Value
violatedDirective object-src
effectiveDirective object-src
blockedUri https://widget.vendor.example/player.swf, self
Issue title object-src blocking widget.vendor.example
  • Any traffic here after you set 'none' is worth reading. On a site with no plugin content, an object-src issue is either an old embed nobody remembers or injected markup.
  • Inline PDF viewers are the common false positive: <object data="/doc.pdf"> is same-origin, so it reports with blockedUri: "self".
Section titled “Related directives”

Getting reports for this directive

Section titled “Getting reports for this directive”

Point your policy’s report-uri at your site’s HeaderHawk endpoint and the violations above arrive in the dashboard, grouped as described. The Quick Start sets that up in five minutes, and the integration guides cover the header syntax for each platform.