Issue
I set up CSP (Content Security Policy) reporting for one of my projects, but I cannot find the CSP reports in Sentry. I want to know where CSP reports appear and how to filter for them.
Applies To
All SaaS Customers and Self-Hosted Users
Security Headers / CSP Reporting
Resolution
CSP reports are ingested as their own event type. To view only CSP events, search with event.type:csp on your Issues or Discover pages. You can narrow further using the tags Sentry sets on each CSP event: effective-directive, blocked-uri, and blocked-host.
[Screenshot: the Issues page filtered by event.type:csp, showing CSP violation events.]
If no CSP events appear, confirm they are being ingested before filtering:
Verify your policy header points to the Sentry security endpoint. Your server must send a
Content-Security-Policy(orContent-Security-Policy-Report-Only) header whosereport-uritargets your project's Security Header endpoint. Find the exact endpoint under Project Settings > Security Headers, and see the Security Policy Reporting documentation for the full header setup, including how to configure your CSP to allow Sentry.Check that the reports are not being filtered out. Under Project Settings > Security Headers > CSP, the "Additional Ignored Sources" field drops reports whose
blocked_uri,source_file, ordocument_urimatch a listed pattern. See how do I filter CSP reports? and how do I configure Content-Security-Policy (CSP) filters? for details and pattern examples.Once reports are arriving, use
event.type:cspon the Issues or Discover page to find them.
For the searchable fields available on events, see the searchable properties reference.