Flip CSP from report-only to enforce-mode after observation period #184

Open
opened 2026-05-14 17:33:08 +00:00 by chihlasm · 0 comments
Owner

CSP is currently in report-only mode. After a 2–3 week quiet observation period in PostHog, flip to enforce-mode.

Plan

  1. Observe CSP violation reports in PostHog for 2–3 weeks of normal traffic
  2. Whitelist legitimate sources (analytics, fonts, images, embedded media, etc.)
  3. Re-verify reports are quiet for at least one full week
  4. Flip Content-Security-Policy-Report-OnlyContent-Security-Policy
  5. Keep the report endpoint live to catch regressions

Acceptance

  • Zero unexpected CSP violations during the final pre-flip observation week
  • Enforce-mode shipped with a documented rollback (revert to report-only header)
  • Dashboard / saved query in PostHog for post-flip violation monitoring
CSP is currently in report-only mode. After a 2–3 week quiet observation period in PostHog, flip to enforce-mode. ## Plan 1. Observe CSP violation reports in PostHog for 2–3 weeks of normal traffic 2. Whitelist legitimate sources (analytics, fonts, images, embedded media, etc.) 3. Re-verify reports are quiet for at least one full week 4. Flip `Content-Security-Policy-Report-Only` → `Content-Security-Policy` 5. Keep the report endpoint live to catch regressions ## Acceptance - Zero unexpected CSP violations during the final pre-flip observation week - Enforce-mode shipped with a documented rollback (revert to report-only header) - Dashboard / saved query in PostHog for post-flip violation monitoring
Sign in to join this conversation.