⚠️ No Connection Allowlist — this page can connect anywhere
← All demos · Connection Allowlist Demo 2 of 4

Path-Level Allowlist

The same host is permitted for one path and refused for another — granularity an origin-level connection control cannot express.

Requires Chrome 152 or later. Other browsers ignore the header, so both modes will behave the same.

One host, two paths, both carried

Same host, different paths

Both buttons connect to this very same origin. Only the path differs.

⚠️ No list is set. Both paths are carried. This is also what you get from a control that can only name an origin: permit the host for one endpoint and you have permitted every other endpoint it serves.
Why this one matters

A CSP connect-src https://demo.report-uri.com permits every path this host serves. If a vendor is on your list for one API, they are on your list for whichever other endpoint an attacker finds most convenient — and so is anyone who can get code running on your page.

Destinations in a Connection Allowlist are URL patterns, so the allowance stops at the endpoint you actually meant.

← Demo 1 Demo 3 →