Does mixed-content protection replace media-src?

No. Mixed content is the URL scheme. media-src is which hosts may load as video or audio.

Does img-src cover files?

No. Posters are img-src. The media resource is media-src. An iframe player is frame-src.

Does RoastMyOpsec score media-src?

It parses http:// assets in HTML and grades CSP quality overall. It does not treat media-src as the only CSP check.

Safety

CSP media-src vs Mixed Content for Public Video

January 11, 2023

CSP media-src vs mixed content for public video is two different media problems. Mixed content is an HTTPS page that still loads http:// video, audio, or other assets — browsers may block or padlock-warn. media-src in Content-Security-Policy lists which origins may be used as <video>, <audio>, and <track> resources, including blob: and data: if you allow them. A tight media-src does not fix http:// on the same host. img-src covers posters and stills, not the media file. RoastMyOpsec's mixed-content check parses landing HTML for http:// script, style, and image URLs. It does not score missing media-src as a standalone F, does not play every <video>, and does not exploit media sinks.

The practical difference

Scheme is mixed content. Host is media-src. A page can be all-HTTPS and still allow media-src * — any origin's MP4, including a tracking beacon wrapped as video. img-src does not cover the media file. frame-src covers an iframe player, not a first-party <video src>.

Hero loops and CDN HLS belong on named HTTPS hosts. blob: from a same-origin MediaRecorder is a product choice; it is not a reason to set *.

How to choose media-src

Brochure with a first-party CDN: media-src 'self' https://video.example.com (or your real host). Third-party players: if they iframe YouTube, that is frame-src, not media-src. Direct MP4 from a vendor: name that host. Mixed content: fix the URLs or use upgrade-insecure-requests, then keep media-src tight. Report-Only first if a CMS injects surprise video hosts.

Control	What it limits	Does not replace	Takeaway
HTTPS + no http:// assets	Mixed content	media-src	See mixed content vs HTTPS
media-src allowlist	Which hosts may be video/audio	Mixed-content scheme	Name CDNs, not *
img-src	Posters and stills	media-src	See img-src vs mixed content
frame-src	Embedded player iframes	media-src	YouTube embed ≠ media-src

When media-src still wins

media-src wins when the page is already HTTPS and a CMS still loads MP4 from anywhere. Mixed-content fixes win first if the HTML still has http://. An iframe player is frame-src; do not confuse the two. Neither is SRI — media files rarely use integrity hashes the way scripts do.

What the roast can prove

http:// image, script, and style URLs in landing HTML can surface. Missing media-src is not scored as its own finding. Confirm the CSP header yourself. Pair with img-src if the poster is the leak.

Common mistakes

The first mistake is media-src * because one campaign video host kept moving.

The second mistake is treating mixed-content off as proof media-src is tight.

The third mistake is putting a YouTube iframe on media-src instead of frame-src.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Does mixed-content protection replace media-src?: No. Mixed content is the URL scheme. media-src is which hosts may load as video or audio.
Does img-src cover <video> files?: No. Posters are img-src. The media resource is media-src. An iframe player is frame-src.
Does RoastMyOpsec score media-src?: It parses http:// assets in HTML and grades CSP quality overall. It does not treat media-src as the only CSP check.