News
HTTP 103 Early Hints vs Content-Security-Policy
April 14, 2024
HTTP 103 Early Hints vs Content-Security-Policy is a speed header versus an allowlist. 103 (RFC 8297) lets a CDN or origin send Link: rel=preload (and similar) while the document is still generating. That is not a substitute for CSP, HSTS, or frame-ancestors on the final 200. Modern Chromium applies the document CSP to early-hinted subresources; do not assume every browser or every proxy does. Do not put secrets or internal hostnames in Link URLs — those leave in the first bytes. RoastMyOpsec grades CSP and other headers on the landing response. It does not score 103, does not follow preload Links as a crawl, and does not treat missing Early Hints as a finding.
The practical difference
Early Hints are a hint: 'you will probably need these URLs.' CSP is a rule: 'scripts may only come from here.' Preload without CSP still loads whatever the Link named if the document would have loaded it anyway. CSP without 103 is still a policy. Use both only if you need the latency win.
dns-prefetch and prefetch are cousins. They can leak destinations in headers the same way. See dns-prefetch vs Referrer-Policy.
How to choose what to send on 103
Preload only public, first-party assets you already allow in CSP (script-src / style-src). Skip authenticated URLs, signed query strings, and admin hosts. If the CDN cannot attach the same CSP to the final response, skip Early Hints until it can.
| Signal | When it fires | Policy role | Takeaway |
|---|---|---|---|
| 103 Link preload | Before the document body | None by itself | Speed only; no secrets in URLs |
| CSP on 200 | With the HTML | Allowlist for scripts and more | Required; see CSP vs XFO |
| CSP Report-Only | With the HTML | Telemetry, not a lock | Do not preload against a policy you have not enforced |
| HSTS | After a trusted HTTPS response | HTTPS memory | Unrelated to 103; still set it |
What the roast can prove
A roast can show CSP (or Report-Only) on the final response. Absence of 103 is not a miss. A 103 that preloads a third-party script you then block in CSP is wasted bandwidth, not a roast finding. Confirm Link URLs in your CDN config.
Common mistakes
The first mistake is preloading a CDN script URL that is not in script-src.
The second mistake is putting a signed asset URL with a token in Link.
The third mistake is treating 103 as 'security headers sent early' and omitting CSP on the 200.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does Early Hints bypass CSP?
- It must not in browsers that apply document CSP to hinted loads. Still put CSP on the final response. Do not rely on 103 for isolation.
- Should every marketing site enable 103?
- Only if the CDN supports it and the preloaded URLs are public first-party assets already allowed by CSP. Missing 103 is not an OPSEC F.
- Does RoastMyOpsec score HTTP 103?
- No. It does not treat missing Early Hints as a finding and does not crawl preload Links.