Content Security Policy (CSP) Reporting Configuration
Learn how to configure Content Security Policy reporting with c/side's reporting endpoint. CSP reporting is available across all c/side subscription tiers.
Service Limits
| Plan | Retention Period | Event Capacity |
|---|---|---|
| Free | 30 days | 500,000 events |
| Business | 90 days | 2,000,000 events |
| Enterprise | 90 days in dashboard 365 cold storage | Unlimited events |
Implementation Guide
Step 1: Configure CSP Headers
Content Security Policy uses directives to control resource loading and execution. For a comprehensive list of available directives, refer to the Mozilla Developer Documentation.
Deployment Modes
CSP supports two operational modes:
- Report-Only Mode: Monitors violations without enforcement
- Enforcement Mode: Actively blocks policy violations
Best Practice: Implement CSP through HTTP response headers rather than HTML meta tags for enhanced security.
Implementation Recommendations
- Begin with Report-Only mode for impact assessment
- Implement essential directives first:
script-src: Control JavaScript source originsimage-src: Manage image loading sourcesfont-src: Restrict font loading sources
- Use
script-src 'self'as a baseline security measure
Note: Automated CSP configuration tooling is scheduled for release in Q3 2025.
Step 2: Configure Reporting Endpoint
Each c/side customer can receive a customer endpoint so please navigate to the CSP reports section of the dashboard to view the CSP reporting endpoint assigned to your account.
Best Practices and Considerations
Important: Always make sure to add proxy.csidetm.com/* to your script-src and connect-src directives.
Environment Management
CSP implementation often varies between development and production environments. Maintain consistent CSP configurations across all environments to prevent deployment issues and security gaps.
Policy Design Strategy
Balance your CSP implementation between:
- Strict Policies: Enhanced security through specific rules, but requires more maintenance
- Permissive Policies: Easier maintenance but may introduce security vulnerabilities
c/side's monitoring capabilities enable you to implement broader rules while maintaining security through comprehensive violation reporting and analysis.
Known Challenges
The connect-src directive requires careful consideration due to dynamic client-side dependencies. When implementing this directive...