Issue
I want examples of how to set the "Additional Ignored Sources" field in my project's CSP settings so I can filter out noisy CSP reports, such as those from browser extensions.
Applies To
All SaaS Customers and Self-Hosted Users
Inbound Filters
Resolution
The "Additional Ignored Sources" field filters out CSP reports you do not want to ingest. Find it under Project Settings, then Security Headers, then CSP Instructions. Sentry matches each pattern against the report's blocked_uri, source_file, and document_uri.
How matching works:
Add one pattern per line.
Sentry matches on scheme, domain, and port. Paths are ignored.
Use
*as a wildcard for any scheme, domain segment, or port.
Accepted pattern formats:
evil.com # domain only
*.evil.com # any subdomain of evil.com
http://*.example.com:8080 # scheme + wildcard domain + port
*://cdn.*.com:* # any scheme, wildcard domain, any port
*:8080 # any source on port 8080
chrome://* # a specific scheme
chrome-extension # browser extension sources
moz-extension # browser extension sources
localhost:3000 # local development
http://192.168.1.1:3000 # IPv4 address
http://[2001:db8::1]:8080 # IPv6 address (in brackets)
Matching examples, given these patterns:
*.evil.com
http://*.example.com:8080
*://cdn.*.com:*
localhost
Incoming source | Ignored? | Reason |
| Yes | Matches |
| No | Matches no pattern |
| Yes | Matches |
| No | Scheme does not match |
| No | Port does not match |
| Yes | Matches |
| No |
|
| Yes | Matches |
| No | Does not match |
A common use case is filtering browser extension noise by adding chrome-extension and moz-extension. For more on collecting and configuring CSP reports, see the Security Policy Reporting documentation.