Lesson 3.4: Content Security Policy reports: catching a skimmer
Web 101 introduced Content-Security-Policy as a header. In practice it's rolled out in two phases: Report-Only, where browsers send a JSON report for everything the policy would have blocked, and enforcement. Those reports are also a sensor: when a third-party script starts loading code from a new domain on the checkout page, the browsers of your own customers tell you. In the lab you read a day of Northwind's CSP reports, separate noise from a web skimmer, trace it to a compromised third-party library, and switch the policy to enforcement without breaking the shop.
17 min
You will learn to
- Explain Report-Only and enforcing CSP
- Read CSP violation reports with jq
- Tell noise (extensions, legacy pages) from attacks
- Recognise a web skimming (Magecart) pattern
- Move a policy to enforcement safely
Key terms
- Content-Security-Policy-Report-Only
- The same policy, evaluated but not enforced; violations are only reported.
- Violation report
- A JSON document the browser sends: page, directive, blocked URI, source file.
- Directive
- One rule of the policy, per resource type: script-src, connect-src, img-src, font-src …
- Web skimming (Magecart)
- Malicious JavaScript on a payment page that copies what customers type and sends it away.
- Third-party script
- Code loaded from someone else's server; it runs with your page's full power.
← Security headers · All lessons · Kerberos pre-authentication and AS-REP roasting →