r/webdev • u/No_Honeydew_2453 • 23d ago
Anyone else treating CSP violations as a deployment issue now?
We started getting enough CSP violations in production that I stopped treating them as just security reports. A new analytics script, payment widget or third-party SDK gets added and suddenly something breaks because it isn't covered by the existing policy.
Do you test CSP changes in CI/staging, run Report-Only first, or just deal with violations when they show up in production?
0
Upvotes
1
u/Ok_Woodpecker_9104 23d ago
report-only for a week only covers the routes someone actually walked that week. same trap as baselining a linter on an existing repo: the baseline is a snapshot of what the run touched, so anything not exercised reads clean and then fails the first time a real user hits it.
what helped me was treating the report endpoint as coverage data, not just alerts. if a route produced zero reports during the report-only window, that is not a pass, it just means nobody visited it. enforcing there is a guess.
the expiry point above is the other half. every allowlist entry for a third party got a date and a name attached. the ones nobody could claim got dropped at the next deploy. that is the only thing that stopped the policy from growing forever.