Browser & Web Performance · Senior · Question 47 of 75

How do you roll out a new CSP without breaking production?

1Add 'unsafe-inline' and 'unsafe-eval' first, then remove them later
2Enable it on Friday and watch the error logs
✓Correct answer: Deploy it as Content-Security-Policy-Report-Only with a reporting endpoint, fix violations, then enforce

Explanation

Report-only mode shows what would be blocked without blocking it. Expect noise from extensions in the reports.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.