Content-Security-Policy-Report-Only should show detailed CSP analysis

[groenroos]

What information was incorrect, unhelpful, or incomplete?

When a Content-Security-Policy-Report-Only header is defined, the "CSP analysis" tab is empty, with an "Implement an enforced policy" exception message.

e.g. https://developer.mozilla.org/en-US/observatory/analyze?host=google.com#csp

What did you expect to see?

As discussed in #5, while the flag and the -25 score is correct, the "CSP analysis" tab should still display the full line-by-line CSP analysis as though the header was enforced. This would help with iterating the CSP policy without causing disruption to users.

Do you have any supporting links, references, or citations?

• Sites sending Content-Security-Policy-Report-Only are reported as "No CSP headers detected" #5
• Example result: https://developer.mozilla.org/en-US/observatory/analyze?host=google.com#csp

Do you have anything more you want to share?

The discussion in the previous issue resolved to initially create the behaviour that currently exists, and follow up after launch with this described behaviour.

That issue was closed as completed when the first step was implemented (possibly because it satisfied the title of the initial issue?). However, displaying the full CSP analysis does not seem to be implemented yet, and so I thought I'd open a separate issue for that.

[github-actions]

It looks like this is your first issue. Welcome! 👋 One of the project maintainers will be with you as soon as possible. We appreciate your patience. To safeguard the health of the project, please take a moment to read our code of conduct.

[argl]

Sorry for the non-movement on this, I just wanted to say that this is still under consideration.

[groenroos]

No worries at all! Happy to hear it's still on the radar! 👍

We had actually paused work on implementing CSP due to policy complexity; but we do plan to take it up again soon, now that the rest of our setup can more easily support Level 3. So, if this tool could help us validate our Report-Only policies while we iterate, that would definitely be huge! 👌

Let me know if I can be of any help!