I am in the process of implementing a CSP policy for a variety of domains and am looking for a method to record/log browser CSP violations encountered by any end user. I want to make sure I don't miss any domains, but would like to avoid having to manually visit every page and check the browser error console. What's the best practice here to identify external domains and resources that may be encountered?
1 Answer
Content Security Policy (CSP) Quick Reference Guide
CSP-Reporting on Google Developers
If you're just starting out with CSP, it makes sense to evaluate the current state of your application before rolling out a draconian policy to your users. As a stepping stone to a complete deployment, you can ask the browser to monitor a policy, reporting violations but not enforcing the restrictions. Instead of sending a Content-Security-Policy header, send a Content-Security-Policy-Report-Only header.
The Reporting API on google.dev
Reporting API on github.io (Editor's Draft)
Report URI Documentation - probably the easiest and fastest way to deploy policies and generate reports to track CSP violations. Includes CSP Analyser, CSP Builder and Data Watch monitoring tool for registered users. However, the free plan includes up to 10,000 reports.
