demo · v133
Live violation harvester
A report-only CSP policy is active on this page. Inject one of the sample inline scripts — Chrome 133 will surface the SHA hash candidate inside the violation report. Collect them into a clip-and-paste script-src directive.
step 1 — inject a sample inline script (each is unique, so each will fire a new violation)
step 2 — harvested hashes (paste these into your real script-src to allow these scripts):
| script (first 40 chars) | hash candidate |
|---|
no violations yet — click a button above
step 3 — assembled directive:
script-src 'self'what changed in 133
The CSP SecurityPolicyViolationEvent — and the report payload sent to report-to endpoints — gained a hashes field for script-source violations. Before 133, when a third-party SDK injected an inline script that didn't match your script-src, all the report told you was "script blocked, source: inline". Now the report includes the canonical hash you'd add to your policy to allow it. The motivation: enforcement-mode CSPs for inline-script-heavy apps used to be a years-long migration of running report-only first, manually computing hashes, and updating policy iteratively. Now the browser does step 2.
document.addEventListener("securitypolicyviolation", (e) => {
console.log(e.violatedDirective); // "script-src"
console.log(e.sample); // first chars of the inline body
console.log(e.hashes); // ["sha256-…"] <-- new in 133
});