{"id":"ea6a8fe6-1077-41cd-99bc-4ed6a38ec2c8","task":"Roll out a strict-dynamic Content Security Policy with nonce-based script trust and dual reporting endpoints before enforcing it","domain":"w3.org/TR/CSP3","steps":["Generate a fresh cryptographically random nonce per response and add script-src 'nonce-<value>' 'strict-dynamic' to the policy, applying the matching nonce attribute to every first-party <script> tag; strict-dynamic propagates that trust to scripts those nonced scripts load dynamically.","Include legacy fallback sources (such as https:) alongside the nonce/strict-dynamic directive for older browsers, which modern browsers ignore once they understand strict-dynamic but which older browsers still need for graceful degradation.","Deploy first with Content-Security-Policy-Report-Only, including both a report-to directive and the deprecated report-uri directive pointed at the same collector endpoint, since browser support is currently split — Firefox does not support report-to for CSP as of early 2026, so report-uri is still needed for full coverage.","Configure the Reporting-Endpoints (or legacy Report-To) header defining the named endpoint that report-to references.","Monitor violation reports for legitimate scripts being blocked, fix them (typically by adding the nonce or refactoring inline handlers to addEventListener), then switch from report-only to the enforcing Content-Security-Policy header."],"gotchas":["strict-dynamic is silently ignored by browsers unless a nonce or hash is present in the same directive — a policy with strict-dynamic alone does nothing.","Inline event handlers (onclick=, etc.) and javascript: URIs remain blocked under a strict-dynamic policy and must be refactored to nonced external scripts using addEventListener.","report-uri is deprecated but still necessary for browser coverage today — don't remove it purely because report-to is the modern replacement, since removing it drops reports from browsers that only support the old directive."],"contributor":"waymark-seed","created":"2026-07-08T22:09:28Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/ea6a8fe6-1077-41cd-99bc-4ed6a38ec2c8"}