Content Security Policy stops inline script execution, in spite of report-only mode

Question

I have a CSP in place with 'Content-Security-Policy-Report-Only' mode and report-uri. I have an inline JavaScript running which the CSP prohibits. My understanding was the JavaScript would still be allowed to run while in report-only mode, but will be reported to the report-uri link. It does gets documented in the report-uri link, but it also stops the page from loading with the following error on the Chrome console: "[Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'".". Why is the CSP being enforced in 'Report-only' mode? Thanks

user1005585 · Accepted Answer · 2020-07-15 18:26:02Z

1

This seems to happen when I set the CSP along with the Header 'Header set Set-Cookie: HttpOnly; SameSite=Strict' in Apache 2.2.3. I removed this header and the CSP works in true report only mode.

answered Jul 15, 2020 at 18:26

user1005585

2855 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Content Security Policy stops inline script execution, in spite of report-only mode

1 Answer 1

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related