Content Security Policy Report-Only: How to Collect and Analyze CSP Violation Reports
Before we enable new Content Security Policy on a working site, we need to make sure it will not break any existing flows. Report-Only mode solves that problem. It lets browsers report CSP violations without enforcing the rules or blocking code execution.
Adding Report-Only policy headers is easy, but to use reports effectively and safely, you need to take a few additional steps. The full flow usually looks like this:
- Configure the reporting endpoint and add the reporting directive to the CSP policy.
- Make sure the reporting endpoint is secure.
- Normalize, validate, and sanitize the report data.
- Group related violations and investigate them.
- Fix the reported violations.
- Enforce the policy.
In this article, we’ll walk through these steps and look at some live examples.
This post is a part a series of posts about CSP, earlier we looked at how Content Security Policy affects application development and how script-src...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
