As Sid pointed out correctly in: > https://bugzilla.mozilla.org/show_bug.cgi?id=1075230#c10 there are 2 things that we currently do different in > http://mxr.mozilla.org/mozilla-central/source/content/base/src/nsCSPUtils.cpp#291 than the specs suggests in: > http://www.w3.org/TR/CSP11/#match-source-expression In particular: * 4.4.1, and 4.4.2

(In reply to Christoph Kerschbaumer [:ckerschb] from comment #0) > than the specs suggests in: > > http://www.w3.org/TR/CSP11/#match-source-expression > > In particular: > * 4.4.1, and 4.4.2 The spec has changed and these references are no longer valid. Looking at the version of the spec at the time of that comment though: https://www.w3.org/TR/2014/WD-CSP2-20140703/#match-source-expression the relevant lines look like: 4.4.1. the scheme of the protected resource’s URI is a case insensitive match for HTTP, and uri-scheme is not a case insensitive match for either HTTP or HTTPS 4.4.2. the scheme of the protected resource’s URI is not a case insensitive match for HTTP, and uri-scheme is not a case insensitive match for the scheme of the protected resource’s URI.