Overview

media-src controls the origins of audio, video, and caption resources loaded by <audio>, <video>, and <track> elements. When omitted it inherits from default-src.

Details

Values include 'self', media CDN hosts, and blob: (often required for streaming and Media Source Extensions). Playing client-generated media streams (e.g., MediaRecorder output, MSE-assembled segments) typically requires allowing blob:. Adaptive streaming such as HLS/DASH fetches segments and plays them as blobs, so you must open both connect-src (segment fetch) and media-src (blob playback).

Embedding external media requires allowlisting its domain, or playback is blocked. Using short data:-encoded notification sounds requires adding data: as well.

Syntax

Content-Security-Policy: media-src 'self' https://media.example.com blob:

Notes

• MSE/streaming playback often needs blob:, and HLS/DASH requires opening both connect-src (segments) and media-src (playback).
• Omitting external audio/video embed domains silently blocks playback.
• Add the data: scheme if you use inline data:-encoded media.

Related directives