> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://uploadcare.com/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://uploadcare.com/docs/_mcp/server.

# Content Security Policy for jQuery File Uploader

> Uploadcare Widget provides an additional layer of security that helps detect certain types of attacks, including cross-site scripting (XSS).

> **Warning**
>
> **Warning:** jQuery File Uploader package is officially deprecated as of **September 1, 2025**.\
>
> Moving forward, we will no longer release updates or new versions of this widget.\
>
> Support will also be discontinued, except in cases where critical security vulnerabilities need to be addressed.\
> \
>
> We recommend considering our [web-component-based File Uploader](/docs/file-uploader/).

Content Security Policy (CSP) is an added layer of security that helps
to detect and mitigate certain types of attacks, including Cross-Site
Scripting (XSS) and data injection attacks. These attacks are used for
everything from data theft to site defacement to malware distribution.

\-- <cite>[MDN Web Docs](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)</cite>

Here is the basic list of rules needed for the [jQuery File Uploader](/docs/uploads/file-uploader/):

This CSP configuration is for the deprecated jQuery-based File Uploader. For current integrations, see the CSP requirements on the File Uploader security page instead.

## frame-src

```
frame-src https://social.uploadcare.com/;
```

We use `iframe` to integrate external upload sources.
You **MUST** add this rule if you are using an external upload
source (such as Facebook or Google Drive).

The list of all available upload sources is [here](/docs/uploads/file-uploader/#upload-sources).

## script-src

```
script-src-elem https://ucarecdn.com/libs/widget/3.x/uploadcare.full.min.js https://ucarecdn.com/libs/widget-tab-effects/1.x/uploadcare.tab-effects.js;
```

This rule applies if you integrate File Uploader via the script tag.
Here you should specify the list of URLs that you use to connect the File Uploader.

The example above specifies two URLs:

* `https://ucarecdn.com/libs/widget/3.x/uploadcare.full.min.js`
* `https://ucarecdn.com/libs/widget-tab-effects/1.x/uploadcare.tab-effects.js`

Those are [File Uploader full minified bundle](/docs/uploads/file-uploader/#bundles) and [Effects Tab bundle](/docs/uploads/image-editor/).

## img-src and media-src

```
img-src https://*.ucarecd.net https://ucarecdn.com blob: data:;
media-src https://*.ucarecd.net https://ucarecdn.com blob:;
```

Here, `*.ucarecd.net` (your project's subdomain) is the current default CDN
domain; `ucarecdn.com` is kept for legacy purposes only.
You should change it in case you're using [Custom CDN CNAME](/docs/delivery/cdn/#custom-cdn-cname).

`blob:` and `data:` are needed to be able to show previews
before file upload.

## style-src

```
style-src 'sha256-z2tSHZZND7S0k4apE+cUuKYecpmTP6hEpQNUsBKJ7/k=' 'sha256-Svhv+Czr4YhnAxqEBWYz7xQFr62J0XStJJwc2l72URI=';
```

The example above specifies two SHA hashes: File Uploader styles
and Effects Tab styles.

File Uploader adds inline styles dynamically, so you need to specify SHA
hash for those styles or use the [unsafe-inline](https://content-security-policy.com/unsafe-inline/)
flag, which is highly unrecommended.

To calculate SHA hash, you could use Chrome Developer Tools:

* Open page with enabled CSP and integrate File Uploader.
* Open Developer Tools and see the console output.

```
uploadcare.full.min.js:35 Refused to apply inline style because it violates the
following Content Security Policy directive: "default-src 'self'".
Either the 'unsafe-inline' keyword, a hash ('sha256-4G3/zsAXNgsfv+V7zWLxJbqyQgdoBPW9c9QT3xIa6L4='),
or a nonce ('nonce-...') is required to enable inline execution.
```

Here is, `'sha256-4G3/zsAXNgsfv+V7zWLxJbqyQgdoBPW9c9QT3xIa6L4='` is the
style's calculated SHA hash which you can use for `style-src` rule.

## connect-src

```
connect-src https://upload.uploadcare.com https://uploadcare.s3-accelerate.amazonaws.com wss://ws.pusherapp.com ws://ws.pusherapp.com
```

While running, File Uploader could make requests to the following list of domains:

* `https://upload.uploadcare.com`: [Upload API](https://uploadcare.com/docs/api/upload/)
* `https://uploadcare.s3-accelerate.amazonaws.com`: [Multipart uploading](https://uploadcare.com/docs/api/upload/upload/multipart-file-upload-start)
* `wss://ws.pusherapp.com` or `ws://ws.pusherapp.com`: [Pusher](https://pusher.com/) WebSocket server we're using to track uploading status. Protocol (secure or insecure) depends on `window.location.protocol` value.