demo · v131

Speculation-Rules header exempt from CSP

Until 131 a strict script-src CSP would refuse to honour a server-sent Speculation-Rules header. This probe lets you set a CSP and header value, then asks the local server to emit the real headers so Chrome can fetch the referenced rules document.

pre-131 behaviour

Speculation rules served via header are treated as script and subject to script-src.

Verdict: -

post-131 behaviour

Speculation-Rules header is exempted - rules are always parsed regardless of script-src.

Verdict: ALLOWED

server response and live probe

waiting for probe...

  
open probe document


  

    
the api


Speculation-Rules: "/rules.json"
Content-Security-Policy: script-src 'self'
// Pre-131: rules rejected (script-src disallows external script).
// Post-131: rules honoured (the header is on a CSP allowlist of its own).

  


  

    
see also