CSP Lab
report endpoint /api/csp-reportSee the enforced page

Same policy, nothing blocked

Nothing is blocked.
Everything is reported.

This page sends the same policy as Content-Security-Policy-Report-Only. The markup below still attempts forbidden things; the browser allows them and files a violation report with this app's own endpoint using report-uri.

Report-OnlyFresh nonce per response · 12 directives · report-uri delivery
Response headerContent-Security-Policy-Report-Only
default-src 'self';
script-src 'self' 'nonce-YDI9VzAYXXcRgRBgPewC2g==' 'strict-dynamic' 'report-sample';
style-src 'self' 'unsafe-inline';
img-src 'self' data: blob:;
connect-src 'self';
font-src 'self';
frame-src 'self';
object-src 'none';
base-uri 'none';
form-action 'self';
frame-ancestors 'none';
report-uri /api/csp-report
report-uri/api/csp-reportworks on HTTP and HTTPS

This page tried to break its own policy

Four elements are in the markup right now. The browser loaded them anyway and sent a violation report for each one.

A remote landscape from picsum.photosimg-src
Reportedpicsum.photos is not in img-src.
frame-src
Reportedexample.org is not in frame-src.
<script>
  window.__staticInlineScriptRan = true;
</script>
script-src
ReportedNo nonce, no unsafe-inline, no execution.
<script
  src="https://code.jquery.com/jquery-3.7.1.min.js">
</script>
script-src
Reportedstrict-dynamic trusts nonce-created scripts, not parser-inserted ones.

Trigger a violation

Each button asks the browser to do something the policy disallows. Watch the feed on the right while the request fails.

Inline event handler

Not run
<button onclick="window.__handlerRan = true">

Reported by script-src, still loads

Remote stylesheet

Not run
example.org/theme.css

Reported by style-src, still loads

Remote image

Not run
picsum.photos/seed/csp-run/320/200

Reported by img-src, still loads

Cross-origin iframe

Not run
example.org/?from=csp-run

Reported by frame-src, still loads

Outbound fetch

Not run
api.github.com/zen

Reported by connect-src, still loads

Inline script with the nonce

Not run
nonce="YDI9VzAY…"

Carries this response's nonce; expected to run

Same-origin fetch

Not run
/api/csp-report (GET)

Same origin; expected to pass

Inline style

Not run
style="background:#096b50"

Permitted by style-src's 'unsafe-inline'

The same violations are printed in the browser console. The feed reads them from the server, which is what makes the round trip visible.