Content-Security-Policy: connect-src directive

Content-Security-Policy: connect-src 'none';
Content-Security-Policy: connect-src <source-expression-list>;

Content-Security-Policy: connect-src https://example.com/

<a ping="https://not-example.com" href="/">Link</a>
<script>
  const response = fetch("https://not-example.com/");

  const xhr = new XMLHttpRequest();
  xhr.open("GET", "https://not-example.com/");
  xhr.send();

  const ws = new WebSocket("wss://not-example.com/");

  const es = new EventSource("https://not-example.com/");

  navigator.sendBeacon("https://not-example.com/", {
    /* … */
  });
</script>