effectiveDirective vs originalPolicy

The policy only contains default-src 'self'. The inline script fires a violation. effectiveDirective is "script-src-elem" but originalPolicy only contains "default-src" — the browser infers the specific directive that applied.

Response header


      Content-Security-Policy-Report-Only: default-src 'self'

Markup triggering violation

<script>void 0;</script>

Violation report