CSP Lab
report endpoint /api/csp-reportSee the report-only twin

Content Security Policy, running live

Nothing loads unless
the policy says so.

This page sends a strict CSP with every response. The markup below deliberately attempts things the policy forbids, and the browser reports each refusal back to this app's own endpoint using report-uri.

EnforcedFresh nonce per response · 12 directives · report-uri delivery
Response headerContent-Security-Policy
default-src 'self';
script-src 'self' 'nonce-rVHdceE9ALCBxbh+AgWXtQ==' 'strict-dynamic' 'report-sample';
style-src 'self' 'unsafe-inline';
img-src 'self' data: blob:;
connect-src 'self';
font-src 'self';
frame-src 'self';
object-src 'none';
base-uri 'none';
form-action 'self';
frame-ancestors 'none';
report-uri /api/csp-report
report-uri/api/csp-reportworks on HTTP and HTTPS

This page tried to break its own policy

Four elements are in the markup right now. The browser stopped them before they loaded; the reports arrived without any JavaScript on our side.

A remote landscape from picsum.photosimg-srcRemote image refused
Blockedpicsum.photos is not in img-src.
frame-srcThird-party frame refused
Blockedexample.org is not in frame-src.
<script>
  window.__staticInlineScriptRan = true;
</script>
script-srcInline script refused
BlockedNo nonce, no unsafe-inline, no execution.
<script
  src="https://code.jquery.com/jquery-3.7.1.min.js">
</script>
script-srcThird-party script refused
Blockedstrict-dynamic trusts nonce-created scripts, not parser-inserted ones.

Trigger a violation

Each button asks the browser to do something the policy disallows. Watch the feed on the right while the request fails.

Inline event handler

Not run
<button onclick="window.__handlerRan = true">

Guarded by script-src

Remote stylesheet

Not run
example.org/theme.css

Guarded by style-src

Remote image

Not run
picsum.photos/seed/csp-run/320/200

Guarded by img-src

Cross-origin iframe

Not run
example.org/?from=csp-run

Guarded by frame-src

Outbound fetch

Not run
api.github.com/zen

Guarded by connect-src

Inline script with the nonce

Not run
nonce="rVHdceE9…"

Carries this response's nonce; expected to run

Same-origin fetch

Not run
/api/csp-report (GET)

Same origin; expected to pass

Inline style

Not run
style="background:#096b50"

Permitted by style-src's 'unsafe-inline'

The same violations are printed in the browser console. The feed reads them from the server, which is what makes the round trip visible.