I would like to start introducing a CSP on a site. I would like to start by adding a report only CSP and only reporting on mixed content, for example when an images is loading from HTTP instead of HTTPS.

I have tired the three following:

<meta http_equiv="Content-Security-Policy-Report-Only" content="upgrade-insecure-requests; report-uri https://example.report-uri.com/r/d/csp/reportOnly"/>
<meta http_equiv="Content-Security-Policy-Report-Only" content="img-src https:; report-uri https://example.report-uri.com/r/d/csp/reportOnly">
<meta http_equiv="Content-Security-Policy-Report-Only" content="block-all-mixed-content; report-uri https://example.report-uri.com/r/d/csp/reportOnly">

But none of these are reporting the CSP violation to the report-uri URL.

How can I create a CSP to only report content (images) that are loading from HTTP?

  • Could you clarify why this would be of benefit from an information security standpoint? Wouldn't generating a report about insecure scripts be more important for making decisions about security, since images files are generally quite safe? If this question is more about coding than principles of information security, it might be more on-topic for StackOverflow.
    – browly
    Sep 14 '18 at 15:54
  • 2
    @browly It seems to me that OP wants to identify all "mixed content" issues. Using CSP reporting for this is a bit of a misuse of what CSP is for, but it doesn't seem like a terrible idea to achieve that goal. It might help if OP clarified what they actually want to achieve, but the question doesn't necessarily seem off-topic to me.
    – tim
    Sep 14 '18 at 19:04
  • 1
    @browly my goal is to start the CSP with something simple that I can show users. By showing how a CSP can identify mixed content and the (no green padlock) or (Not secure) message. I am hoping if I can gain success with that, then I can gain traction with users and then start to white list scripts and use CSP to better manage content and security on the site. I have tried reporting on scripts but that raised more reports than I could begin to start dealing with.
    – user802599
    Sep 17 '18 at 1:43
  • Have you managed to get it to send any reports at all? To my untrained eye all three looks like good options, so I suspect that you might have some trouble with the server accepting the reports. I could be wrong, though.
    – Anders
    Sep 17 '18 at 8:24
  • @user802599 Thanks for clarifying. I recommend you edit your question to include that information about your goal, rather than just having it in the comments.
    – browly
    Sep 17 '18 at 15:40

Still not sure why this is failing but I was able to find that if I added a CSP heading to the site set to allow everything and then set a meta tag to disallow what I wanted to disallow that worked.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.