demo · v133

Report payload — before & after

Two violation reports for the same offending inline script — one shaped by pre-133 Chrome, one shaped by Chrome 133. Toggle the SecurityPolicyViolationEvent object view and the wire-format JSON sent to a report-to endpoint.

view

pre Chrome 133

…

Chrome 133+

…

what changed

Pre-133 reports name the violation by selector or by element source position, but they don't tell you what the script body was. To migrate an existing site to a hash-based CSP you had to scrape your own pages, find every inline script, and hash it yourself — impossible if the third-party tags are injected by a tag manager whose output you don't control. The 133 change ships the hash inline, so the CSP report itself becomes the migration source-of-truth.

// SecurityPolicyViolationEvent.scriptSample.hash (Chrome 133+)
document.addEventListener("securitypolicyviolation", (e) => {
  if (e.scriptSample && e.scriptSample.hash) {
    allowlist.add("'sha256-" + e.scriptSample.hash + "'");
  }
});

see also