demo · v138

Violation reporter

A simulated app under three different Integrity-Policy postures. Pick a mode, try to inject scripts. The header rewrites on the page, scripts get attempted, and a reporter feed shows what the browser allowed, blocked, or report-only logged — the rollout workflow the spec recommends.

Enforce gradually. Use Integrity-Policy-Report-Only first to find every offending script across your site without breaking anything. Only switch to Integrity-Policy once the reporter shows zero violations.
allowed0
reported0
blocked0

the headers

// Step 1 — gather data without breaking the site
Integrity-Policy-Report-Only: blocked-destinations=(script), endpoints=(report-collector)

// Step 2 — once the report is clean, switch to enforcement
Integrity-Policy: blocked-destinations=(script)
Reporting-Endpoints: report-collector="https://csp.example/report"

// Scripts without an integrity= attribute are then blocked. SRI hashes
// that match the response body are honoured; anything else is rejected.

see also