According to the CSP2 spec, the value of a -src directive contains three parts: - protocol/scheme (optional) - hostname (mandatory) - path (optiona

According to the CSP2 spec, the value of a -src directive contains three parts: - protocol/scheme (optional) - hostname (mandatory) - path (optional) Notably, there is no query portion or fragment portion; browsers are expected to ignore those. Path matching works like a prefix if it ends in a slash. If it doesn't, only exactly that path matches. In CSP3, the secure protocol/scheme (https, wss) always matches, even if you explicitly specify http:// http://. In CSP2, the implicit scheme matches either; an explicit scheme only matches that scheme. This is typically not useful behavior because you probably have HSTS anyway, so people just use hostnames and only rarely specify the protocol. Most values in practice seem to just be hostnames in general; paths too are rare.