Issue
My site uses a Content Security Policy (CSP), and I need to know which directives to add so Sentry can load and send events without being blocked by the CSP.
Applies To
All SaaS Customers and Self-Hosted Users
JavaScript SDK (Browser)
Session Replay
Resolution
The exact CSP you need depends on your site and which Sentry features you load, so there is no single value that fits every site. At a minimum, allow your application to send events to your Sentry ingestion endpoint by adding your DSN's host to the connect-src directive:
connect-src 'self' https://o<your-org-id>.ingest.<region>.sentry.io;
Use the host from your own DSN (found in Project Settings > SDK Setup > Client Keys (DSN)).
For feature-specific requirements, follow the documentation:
For the loader script and general browser setup, see the JavaScript loader CSP guidance.
For Session Replay (which has additional requirements, such as allowing its web worker), see the Session Replay CSP guidance. If replays render blank after your CSP is correct, that is usually a CORS issue instead. See Why are my replays blank?.
Note: Configuring your CSP to allow Sentry is different from using Sentry as a CSP report collector (Sentry receiving Content-Security-Policy, Expect-CT, and HPKP violation reports). To set that up, see Security Policy Reporting; to filter noisy CSP reports once you receive them, see How do I configure Content-Security-Policy (CSP) filters?.