Violation report fields

The page contains an inline <script> tag without a nonce. Under Content-Security-Policy-Report-Only, the browser does not block it — but it sends a violation report. effectiveDirective is "script-src-elem" even though the policy only contains "default-src". blockedURL is "inline" — a special keyword, not a URL.

Response header


      Content-Security-Policy-Report-Only: default-src 'self'

Markup triggering violation

<script>void 0;</script>

Violation report