Which CSP directive limits where fetch, XHR and WebSocket connections can go?

Explanation

connect-src makes it harder for injected code to send data to an attacker's server, although other channels like images still exist.

Further reading

• MDN: Content Security Policy ↗