CSP: prefetch-src

Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.

The HTTP Content-Security-Policy (CSP) prefetch-src directive specifies valid resources that may be prefetched or prerendered.

CSP version	3
Directive type	Fetch directive
`default-src` fallback	Yes. If this directive is absent, the user agent will look for the `default-src` directive.

Syntax

One or more sources can be allowed for the prefetch-src policy:

Content-Security-Policy: prefetch-src <source>;
Content-Security-Policy: prefetch-src <source> <source>;

<source> can be any one of the values listed in CSP Source Values.

Note that this same set of values can be used in all fetch directives (and a number of other directives).

Given a page with the following Content Security Policy:

Content-Security-Policy: prefetch-src https://example.com/

Fetches for the following code will return network errors, as the URLs provided do not match prefetch-src's source list:

    <link rel="prefetch" href="https://example.org/" />
    <link rel="prerender" href="https://example.org/" />

Specification
Content Security Policy Level 3 # directive-prefetch-src

	Desktop						Mobile
	Chrome	Edge	Firefox	Internet Explorer	Opera	Safari	WebView Android	Chrome Android	Firefox for Android	Opera Android	Safari on IOS	Samsung Internet
`prefetch-src`	No See bug 801561.	No See bug 801561.	No See bug 1457204.	No	No See bug 801561.	No See bug 185070.	No See bug 801561.	No See bug 801561.	No See bug 1457204.	No See bug 801561.	No See bug 185070.	No See bug 801561.