1439797 - Enable reporting-only CSP by default

Status: RESOLVED FIXED

(bugzilla.mozilla.org :: General, enhancement)

Description

[Dylan Hardison [:dylan] (he/him)]

I was chatting with April today about blockers in finishing CSP for BMO, and one thing that came out of it was using CSP in report-only mode can be a help debugging aid. 

Then later in a chat with bobm, report-only CSP came up again. The library I wrote for this supports report-only mode.

So I think I will swap out the "default disabled" logic for "default report". I'll also add csp nonces to every <script> tag, which means the only things in the error console should be javascript: links and inline onEVENT= handlers.

Comment 1

[Dylan Hardison [:dylan] (he/him)]

Attachment: PR

Comment 2

[Ed Morley [:emorley]]

What endpoint are you using to send the CSP reports to? Something Bugzilla specific, or something that other services could use too? :-)