Roll out Content-Security-Policy-Report-Only safely: report-uri/report-to, owned collectors, violation triage, noise filtering, gradual directive tightening, canary then enforce. Use when staging CSP without blocking production, cutting report floods, migrating report-only to Content-Security-Policy, or planning dual-header CSP rollouts — hand DOM XSS proof to xss-cross-site-scripting and Trusted Types adopt to trusted-types-adoption; CSP bypass research to content-security-policy-bypass.
Roll out Content-Security-Policy-Report-Only safely: report-uri/report-to, owned collectors, violation triage, noise filtering, gradual directive tightening, canary then enforce. Use when staging CSP without blocking production, cutting report floods, migrating report-only to Content-Security-Policy, or planning dual-header CSP rollouts — hand DOM XSS proof to xss-cross-site-scripting and Trusted Types adopt to trusted-types-adoption; CSP bypass research to content-security-policy-bypass.
CSP Report-Only Rollout
Deploy Content-Security-Policy-Report-Only first, measure violations, filter
noise, tighten directives, then flip to enforcing Content-Security-Policy
with rollback. Owned apps, staging, labs, and authorized assessments only.
When To Use
Adding or migrating CSP via Report-Only before enforce.
Wiring report-uri / report-to (Reporting API) to an owned collector.
Flooded CSP reports, extension noise, or third-party widget violations.
Gradual tighten of script-src, style-src, connect-src, img-src, etc.
Dual-header canaries (enforce on slice, report-only on main) until clean.
Do not use as primary for XSS PoCs (xss-cross-site-scripting), Trusted
Types (trusted-types-adoption), CSP bypass (content-security-policy-bypass),
or edge header lists alone (nginx-security-headers).
Scope And Authorization
In scope: org-owned frontends/edges you may change; staging/prod under
written engagement; labs/CTFs with CSP report endpoints.
Out of scope: report sinks you do not own; collector DoS; mass crawl.
Prefer header review + controlled browser traffic. Redact cookies, tokens,
PII. Keep original headers and sample reports immutable.
Workflow
1. Baseline delivery and assets
Capture CSP and CSP-RO on document, error, and CDN paths.
Inventory first- vs third-party scripts, styles, fonts, frames, fetch/XHR,
workers, inline handlers (templates, tag managers, SPAs).
Note nonces/hashes, 'strict-dynamic', 'unsafe-inline'/'unsafe-eval',
and any require-trusted-types-for (→ trusted-types-adoption).
Edge vs app emission: avoid conflicting dual CSPs (nginx-security-headers).
2. Owned reporting path
Prefer Reporting API (Reporting-Endpoints + CSP report-to) with legacy
report-uri fallback. Collector must be first-party/org-owned HTTPS; rate-limit
and drop floods; strip cookies/Authorization; controlled retention.
This skill owns Report-Only measurement, reporting plumbing, noise control,
and graduated enforce. Hand XSS to xss-cross-site-scripting and Trusted Types
to trusted-types-adoption.
Output Checklist
Scope/authorization; hosts and paths covered
Baseline CSP and CSP-RO headers quoted (per critical path)
