Violation report fields

The page loads a <script src="https://…"> from an external origin not in the policy. The browser reports the violation but does not block the request. blockedURL is a real URL. sourceFile, lineNumber, and columnNumber are empty or zero — the violation is a network fetch, not a line in the page source.

Response header


      Content-Security-Policy-Report-Only: default-src 'self'

Markup triggering violation

<script src="https://cdn.example.com/lib.js"></script>

Violation report