v131 · miscellaneous

Exempt Speculation-Rules Header from CSP restrictions

This is somewhat of a bug-fix, but it's a web-exposed bug fix which deserves full web platform security review, so we're using the Intent to Ship process. When we initially shipped the Speculation-Rules header, we reused much of the architecture from the <script type=speculationrules> implementation, and thus it was blocked by CSP policies that blocked <scr

concepts

  1. Spec Rules CSP exemption

    Speculation-Rules HTTP header bypasses script-src/inline CSP restrictions. Header-based speculation no longer requires CSP relaxation.

  2. CDN-injected rules

    The planning use case: edge CDNs injecting prefetch rules on behalf of customers without needing CSP relaxation.

  3. CSP × surface tester

    Pick a CSP. See each delivery surface (inline script vs header) verdict it. v131 exempts the header.

  4. Header format builder

    Edit a speculation rules JSON document. Generates the HTTP response + Express handler that delivers it.

why it shipped

When we initially shipped the Speculation-Rules header, we reused much of the architecture from the <script type=speculationrules> implementation, and thus it was blocked by CSP policies that blocked <script> elements. This has caused some friction among web developers adopting the Speculation-Rules header, who expected CSP to only apply to <script>s. After consulting with Google and Chrome security teams, we realized our initial implementation was a mistake, as CSP's script policies are meant to protect against injection of scripts into HTML, and the CSP threat model doesn't relate to HTTP he

references