Guide
Content Security Policy Debugging Guide
Read policy delivery, directives, sources, and browser violations as separate evidence.
Reviewed against the listed primary reference and synthetic local workflow; this is not a runtime or security certification.
Related tools
The debugging problem
A broad or duplicated directive can weaken intended restrictions; a report-only policy can record violations while allowing a resource.
A practical sequence
- Confirm whether the field is enforcing or report-only.
- Inspect each directive and its source list.
- Review violation reports against the actual blocked resource.
- Remove risky expressions only after verifying application dependencies.
Synthetic example
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'A failure to watch for
Assuming report-only blocks a script leads to false assurance. Assuming all inline code is safe because a page loads hides policy gaps.
Limits and interpretation
A static checker cannot prove application security, nonce generation quality, or runtime resource behavior.
References
FAQ
What should I verify first when using this content security policy debugging guide workflow?
Confirm whether the field is enforcing or report-only.
What can this workflow not prove?
A static checker cannot prove application security, nonce generation quality, or runtime resource behavior.