Content-Security-Policy-Report-Only

The Content-Security-Policy-Report-Only HTTP header is a powerful security feature that allows web developers to test and monitor potential security violations for their web applications without actually enforcing the policy. This header is used to specify a Content Security Policy (CSP) in report-only mode, meaning that any violations will be reported but not blocked.

Usage

To use the Content-Security-Policy-Report-Only header, include it in the HTTP response with a policy string that defines the allowed sources for various content types. When the browser encounters a violation of the specified policy, it will send a report to a specified URI instead of blocking the content.

Here’s an example of how to set the Content-Security-Policy-Report-Only header in an HTTP response:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Security-Policy-Report-Only: default-src 'self'; img-src 'self' https://img.example.com; report-uri /csp-report-endpoint

In this example, the policy allows content to be loaded only from the same origin as the page ('self') and images from https://img.example.com. Any violations of this policy will be reported to /csp-report-endpoint.

Reporting Violations

When a policy violation occurs, the browser will send a JSON-formatted report to the specified report-uri. The report contains information about the violation, such as the blocked URI, the violated directive, and the original policy.

Here’s an example of a violation report:

{
  "csp-report": {
    "document-uri": "https://example.com/page.html",
    "referrer": "https://referrer.example.com",
    "blocked-uri": "https://blocked.example.com/script.js",
    "violated-directive": "default-src 'self'",
    "original-policy": "default-src 'self'; report-uri /csp-report-endpoint"
  }
}

In this example, the violation report indicates that a script from https://blocked.example.com/script.js was blocked because it violated the default-src 'self' directive.

Benefits

Using the Content-Security-Policy-Report-Only header has several benefits:

Testing policies: It allows you to test new CSP policies without breaking your application. You can monitor the violation reports and adjust your policy accordingly before enforcing it using the Content-Security-Policy header.
Monitoring third-party content: You can use this header to monitor third-party content providers and ensure they comply with your security policies.
Identifying potential security risks: By monitoring violation reports, you can identify potential security risks in your application and take necessary actions to mitigate them.

Limitations

While the Content-Security-Policy-Report-Only header is a valuable tool for testing and monitoring CSP policies, it has some limitations:

Lack of enforcement: The header does not enforce the policy, so it won’t prevent actual security violations from occurring. It’s essential to eventually enforce the policy using the Content-Security-Policy header once you’re confident in its effectiveness.
Browser support: Not all browsers support the Content-Security-Policy-Report-Only header. Therefore, it’s important to consider browser compatibility when using this feature.

Summary

The Content-Security-Policy-Report-Only header is a useful tool for testing and monitoring CSP policies without enforcing them. By including this header in your HTTP responses, you can gather valuable information about potential security violations and adjust your policies accordingly before enforcing them using the Content-Security-Policy header. However, it’s important to be aware of its limitations and ensure that you eventually enforce your policies to protect your application from security risks.

Was this helpful?

Thanks for your feedback!