CSP reporting endpoint configured

Without a CSP reporting endpoint, policy violations — whether from a blocking misconfiguration or an active injection attempt — are silently swallowed. You have no visibility into resources your CSP is blocking for legitimate users (causing silent breakage) or into attack probes testing your policy's edges. CWE-693 applies: a protection mechanism with no feedback loop cannot be maintained or improved. OWASP A05 (Security Misconfiguration) calls out absence of security monitoring as a configuration failure — deploying CSP without reporting is operationally equivalent to deploying a firewall with no logs.

Add a report-uri or report-to directive pointing to a violation collection endpoint. Free options include report-uri.com; Sentry and Datadog also accept CSP reports.

Content-Security-Policy:
  default-src 'self';
  script-src 'nonce-{perRequest}' 'strict-dynamic';
  report-uri /api/csp-report;
  report-to csp-endpoint

For zero-friction monitoring while tightening policy, start with Content-Security-Policy-Report-Only using the same directives — violations are reported but not blocked, letting you audit without breaking production users.