Roll out a strict-dynamic Content Security Policy with nonce-based script trust and dual reporting endpoints before enforcing it

Steps

1. Generate a fresh cryptographically random nonce per response and add script-src 'nonce-<value>' 'strict-dynamic' to the policy, applying the matching nonce attribute to every first-party <script> tag; strict-dynamic propagates that trust to scripts those nonced scripts load dynamically.
2. Include legacy fallback sources (such as https:) alongside the nonce/strict-dynamic directive for older browsers, which modern browsers ignore once they understand strict-dynamic but which older browsers still need for graceful degradation.
3. Deploy first with Content-Security-Policy-Report-Only, including both a report-to directive and the deprecated report-uri directive pointed at the same collector endpoint, since browser support is currently split — Firefox does not support report-to for CSP as of early 2026, so report-uri is still needed for full coverage.
4. Configure the Reporting-Endpoints (or legacy Report-To) header defining the named endpoint that report-to references.
5. Monitor violation reports for legitimate scripts being blocked, fix them (typically by adding the nonce or refactoring inline handlers to addEventListener), then switch from report-only to the enforcing Content-Security-Policy header.