4

I've created a content security policy for our sites, but i'd like to trial it first to see if it will cause any problems so I've used the report only header and added a report-uri directive.

The header name X-WebKit-CSP-Report-Only works correctly in Webkit based browsers, but neither X-Content-Security-Policy-Report-Only or Content-Security-Policy-Report-Only work in Firefox (version 15). X-Content-Security-Policy works, sending violation reports to the URL specified in my report-uri directive. However, this also implements the policy which I don't want to do yet. Has anyone else come across this?

4
  • The header name "x-content-security-policy-report-only" should work fine as far as I can tell.... Oct 3, 2012 at 18:42
  • Thanks, but it doesn't work in Firefox 14 or 15. Oct 4, 2012 at 9:35
  • 2
    Hmm. Are you basically seeing something like bugzilla.mozilla.org/show_bug.cgi?id=687086 ? Or are you seeing lack of reports for policies other than inline-script and eval-script? Oct 4, 2012 at 13:37
  • Yes, that answers that question. Thanks Boris. Oct 13, 2012 at 17:48

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.