CSP Monitoring Best Practices

Why Monitor CSP Violations?

Effective CSP monitoring helps you identify policy issues, track security threats, and continuously improve your security posture. Without monitoring, you won't know if your CSP is working correctly or if legitimate resources are being blocked.

Setting Up Violation Reporting

Content-Security-Policy: default-src 'self'; report-uri /csp-report;

Configure your CSP to report violations to your monitoring system. You can use either report-uri (legacy) or report-to (newer):

Modern Reporting with report-to

Content-Security-Policy: default-src 'self'; report-to csp-endpoint;
Report-To: {"group": "csp-endpoint", "max_age": 10886400, "endpoints": [{"url": "/csp-report"}]}

The newer report-to directive provides more structured reporting:

Violation Report Structure

{
  "csp-report": {
    "document-uri": "https://example.com/page",
    "referrer": "https://example.com/",
    "violated-directive": "script-src 'self'",
    "effective-directive": "script-src",
    "original-policy": "default-src 'self'; script-src 'self'",
    "disposition": "enforce",
    "blocked-uri": "https://evil.com/malicious.js",
    "line-number": 5,
    "column-number": 10,
    "source-file": "https://example.com/page"
  }
}

Understanding the structure of violation reports helps you analyze them effectively:

Analyzing Violation Reports

Look for patterns in violations to identify legitimate resources that need to be added to your policy:

Common Violation Patterns

• Third-party scripts from CDNs
• Inline scripts and styles
• Analytics and tracking scripts
• Social media widgets
• Payment processing scripts
• Font loading from external sources

Setting Up Monitoring Dashboards

Create dashboards to visualize CSP violations and track trends over time:

Key Metrics to Track

• Total violation count per day/week
• Violations by directive type
• Most common blocked resources
• Violations by page/endpoint
• Trend analysis over time
• False positive rate

Alerting on CSP Violations

Set up alerts for unusual CSP violation patterns that might indicate attacks:

Alert Conditions

• Sudden spike in violation count
• New violation types appearing
• Violations from suspicious domains
• Violations affecting critical pages
• Repeated violations from same source

CSP Testing and Validation

Regularly test your CSP implementation to ensure it's working correctly:

Testing Checklist

• Test all major user flows
• Verify third-party integrations work
• Check mobile and desktop browsers
• Test with different user roles
• Validate error handling pages
• Test offline functionality