upgrade-insecure-requests directive present

Mixed content — HTTP resources on HTTPS pages — is blocked or flagged by modern browsers, but the underlying cause is often hardcoded http:// URLs in templates, user-generated content, or legacy code. upgrade-insecure-requests acts as a browser-side safety net that auto-upgrades HTTP subresource requests to HTTPS, preventing mixed-content blocks from silently breaking functionality for users on HTTPS pages. CWE-311 (Missing Encryption of Sensitive Data) and OWASP A02 (Cryptographic Failures) both apply when application resources are loaded over unencrypted HTTP, exposing data to network-level interception even on nominally HTTPS pages.

Add upgrade-insecure-requests as a directive in your existing CSP header. It requires no configuration — the browser handles all HTTP-to-HTTPS upgrades automatically.

Content-Security-Policy: upgrade-insecure-requests; default-src 'self'; script-src 'nonce-{perRequest}' 'strict-dynamic'

This directive is additive and safe to deploy immediately alongside an existing policy. It does not affect navigation (<a href> clicks) — only subresource loads (<img>, <script>, <link>, <iframe>, etc.). Fix the root-cause http:// URLs as a follow-up — upgrade-insecure-requests is a safety net, not a substitute for correct URLs.