I am in the process of implementing a CSP policy for a variety of domains and am looking for a method to record/log browser CSP violations encountered by any end user. I want to make sure I don't miss any domains, but would like to avoid having to manually visit every page and check the browser error console. What's the best practice here to identify external domains and resources that may be encountered?


Content Security Policy (CSP) Quick Reference Guide

CSP-Reporting on Google Developers

If you're just starting out with CSP, it makes sense to evaluate the current state of your application before rolling out a draconian policy to your users. As a stepping stone to a complete deployment, you can ask the browser to monitor a policy, reporting violations but not enforcing the restrictions. Instead of sending a Content-Security-Policy header, send a Content-Security-Policy-Report-Only header.

  1. The Reporting API on google.dev

  2. Reporting API on github.io (Editor's Draft)

  3. Report URI Documentation - probably the easiest and fastest way to deploy policies and generate reports to track CSP violations. Includes CSP Analyser, CSP Builder and Data Watch monitoring tool for registered users. However, the free plan includes up to 10,000 reports.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.