CSP Security query

Hi,

Where can I find clarification regarding schemes, and their usage ?

https://www.w3.org/TR/CSP3/

https://www.w3.org/TR/CSP2/

 

 

For instance, 

 
Content-Security-Policy: default-src 'self' http: 
In the example above, the http: scheme would effectively override the specific domain settings in the default-src attribute. This would allow ALL http urls to be loaded regardless of the domains listed in default-src (it appears to be the equivalent of adding http://*). It appears this would be true of any scheme added to the CSP.

This in mind, for tightening Security, should all schemes be disallowed as they over-ride default-src

Such as – data:, filesystem:, mediastream, blob: http:, https:, ftp:, sftp:

Thanks,

Sunitha