Issue
My project receives Content Security Policy (CSP) violation reports that create noisy events, often from browser extensions or third-party scripts. These reports are sent by the browser, not by a Sentry SDK, so I cannot filter them in SDK configuration. I want to stop specific CSP reports from being ingested so they no longer count against my error quota.
Applies To
All SaaS Customers and Self-Hosted Users
Content Security Policy (CSP) Reporting / Inbound Filters
Resolution
Filter CSP reports server-side using the ignored sources setting in your project's Security Headers configuration. CSP reports come from the browser, so this is configured in Sentry, not in an SDK.
Go to Settings > Projects > [your project] > Security Headers > CSP.
Under CSP Settings, add one source per line to Additional ignored sources. Sentry discards a report when the pattern matches the report's
blocked_uri,source_file, ordocument_uri.Optionally enable Use default ignored sources to also apply Sentry's built-in list of common noisy sources.
Sentry matches on scheme, domain, and port (paths are ignored), and supports * as a wildcard. For example, to filter browser-extension noise:
chrome-extension
moz-extension
For the full pattern reference and detailed matching examples, see how to configure CSP filters.
Filtered CSP reports are dropped on ingest by an inbound filter, so they do not count against your quota. They appear under Stats as "Filtered". For details on collecting and configuring CSP reports, see the security policy reporting documentation.