WPT
wpt / content-security-policy / embedded-enforcement / subsumption_algorithm-host_sources-protocols.html
Spec: Content Security Policy: Embedded Enforcement ↗
Runs: Chrome 155.0.8041.0 (wpt@2c385f65e, 2026-09-04) | Firefox 157.0a1 (wpt@2c385f65e, 2026-09-04) | Safari 251 preview (wpt@5ce815a83, 2026-08-27) | Ladybird 1.0-a7825 (wpt@2c385f65e, 2026-09-04) | Servo Servo 0.6 (wpt@7e3d005d7, 2026-09-03) | Blitz a50cb8971 (wpt@a95401e4e, 2026-09-03)
View on the Blitz WPT dashboard | Open test on wpt.live | wpt.fyi
| Chrome | Firefox | Safari | Ladybird | Servo | Blitz | |
|---|---|---|---|---|---|---|
| Total | 11/11 | 7/11 | 7/11 | 7/11 | 7/11 | NOT RUN |
| Subtest | Chrome | Firefox | Safari | Ladybird | Servo | Blitz |
|---|---|---|---|---|---|---|
| `https` is more restrictive than `http`. | PASS | FAIL | FAIL | FAIL | FAIL | — |
| The reverse allows iframe be to be loaded. | PASS | PASS | PASS | PASS | PASS | — |
| Matching `https` protocols. | PASS | PASS | PASS | PASS | PASS | — |
| `http:` should subsume all host source expressions with this protocol. | PASS | PASS | PASS | PASS | PASS | — |
| `http:` should subsume all host source expressions with `https:`. | PASS | PASS | PASS | PASS | PASS | — |
| `http:` does not subsume other protocols. | PASS | FAIL | FAIL | FAIL | FAIL | — |
| If scheme source is present in returned csp, it must be specified in required csp too. | PASS | FAIL | FAIL | FAIL | FAIL | — |
| `http:` subsumes other `http:` source expression. | PASS | PASS | PASS | PASS | PASS | — |
| `http:` subsumes other `https:` source expression and expressions with `http:`. | PASS | PASS | PASS | PASS | PASS | — |
| All scheme sources must be subsumed. | PASS | FAIL | FAIL | FAIL | FAIL | — |
| All scheme sources are subsumed by their stronger variants. | PASS | PASS | PASS | PASS | PASS | — |