Unverified50% confidenceFactExact time
CSP only takes effect on documents loaded via HTTP(S) or data: URLs, and local files loaded via the file:// protocol inherit no CSP by default.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn Chromium, a file:// page can use fetch() to read other local files and inherits no CSP.71% similarUnverifiedCSP (Content Security Policy) is a set of browser security rules delivered by the server via HTTP response headers (such as Content-Security-Policy), used to declare which sources of resources a page is allowed to load, with typical directives including script-src, img-src, connect-src, and frame-ancestors.69% similarUnverifiedA data: URL embeds the file content in the URL, and the browser treats it as an opaque origin, so it cannot access other local files via relative paths or scripts.67% similarUnverifiedHTML files smaller than 256KB are loaded in the preview panel as data: URLs, with a CSP of script-src 'none' and an opaque origin, and inline scripts are blocked.67% similarUnverified将CSS和JavaScript内联到单个HTML文件中，虽然牺牲了代码可维护性，但实现了一个文件即整个网站的零障碍部署65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1061017API
curl https://kongchang.com/api/v1/knowledge/claims/1061017MCP
get_claim(id=1061017)