In JavaScript, the securitypolicyviolation event fires when a Content Security Policy (CSP) is violated (MDN). The event type is a SecurityPolicyViolationEvent.
Register a listener with addEventListener. Check readiness and browser support before you rely on this event.
Listen for securitypolicyviolation. Start with this line.
addEventListener("securitypolicyviolation", fn)| Call | What it does |
|---|---|
addEventListener("securitypolicyviolation", fn) | Primary signature. |
Built into the browser. Listen with el.addEventListener("securitypolicyviolation", …) — no import required.
addEventListener("securitypolicyviolation", fn)This member has no parameters beyond those shown in the signature.
| Return Value | Description |
|---|---|
| * | Fires as an Element event (listener receives the Event object). |
windowMDN’s top-level pattern using addEventListener.
window.addEventListener("securitypolicyviolation", (e) => {
console.log("CSP violation");
console.log(e.type);
});window or document matches MDN."securitypolicyviolation".e.type is the event name string.Read blockedURI, violatedDirective, and originalPolicy.
document.addEventListener("securitypolicyviolation", (e) => {
console.log(e.blockedURI);
console.log(e.violatedDirective);
console.log(e.originalPolicy);
});effectiveDirective).When a real CSP block is unavailable, dispatch a sample event to practice reading fields.
document.addEventListener("securitypolicyviolation", (e) => {
console.log(e.blockedURI);
console.log(e.violatedDirective);
});
document.dispatchEvent(
new SecurityPolicyViolationEvent("securitypolicyviolation", {
blockedURI: "https://cdn.example/x.png",
violatedDirective: "img-src",
effectiveDirective: "img-src",
originalPolicy: "img-src 'none'",
disposition: "enforce",
documentURI: document.documentURI,
statusCode: 200
})
);new SecurityPolicyViolationEvent(…) fills demo fields.securitypolicyviolation is Baseline Widely available (MDN: since October 2018). Safe to use in modern evergreen browsers.
Fires when a Content Security Policy is violated — listen on window or document.
Bottom line: Listen on window or document, log SecurityPolicyViolationEvent fields, and pair with a real CSP policy for production monitoring.
Learn when a touch sequence is interrupted by the browser.
11 people found this page helpful