CSP Report-Only
CSP Report-Only mode only reports violations without blocking, used to deploy CSP progressively without breaking functionality.
Purpose
To collect CSP violation reports without blocking, evaluating the policy safety before switching to enforcing mode.
Mechanism
The Content-Security-Policy-Report-Only header uses the same syntax as CSP but only reports. On violation the browser POSTs a report to report-uri (including the violated directive, source, line and column). After analysis, switch to an enforcing CSP.
Use cases
- Progressive CSP deployment
- Violation monitoring
- Policy evaluation