<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - CSP: Report nonce violations in report-only polices"
href="https://bugs.webkit.org/show_bug.cgi?id=159830#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - CSP: Report nonce violations in report-only polices"
href="https://bugs.webkit.org/show_bug.cgi?id=159830">bug 159830</a>
from <span class="vcard"><a class="email" href="mailto:dbates@webkit.org" title="Daniel Bates <dbates@webkit.org>"> <span class="fn">Daniel Bates</span></a>
</span></b>
<pre>(In reply to <a href="show_bug.cgi?id=159830#c0">comment #0</a>)
<span class="quote">> We should send a CSP violation report and log a console message when there
> is a nonce violation in a report-only policy.</span >
Further elaborating, we need to send a CSP violation report and log a console message for each report-only that does not contain the nonce even if the nonce is found in all enforced policies. For example:
...
Content-Security-Policy-Report-Only: script-src 'nonce-NonExistentNonce'
Content-Security-Policy: script-src 'nonce-A'
...
<html>
<body>
<script nonce="A">...</script>
</body>
</html>
This should send exactly one CSP violation report and log exactly one console message that explains that the nonce "A" was not found in the report-only policy.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>