SecurityPolicyViolationEvent

Baseline Widely available *

This feature is well established and works across many devices and browser versions. It’s been available across browsers since August 2016.

* Some parts of this feature may have varying levels of support.

Note: This feature is available in Web Workers.

The SecurityPolicyViolationEvent interface inherits from Event, and represents the event object of a securitypolicyviolation event sent on an Element, Document, or worker when its Content Security Policy (CSP) is violated.

Constructor

SecurityPolicyViolationEvent(): Creates a new SecurityPolicyViolationEvent object instance.

Instance properties

SecurityPolicyViolationEvent.blockedURI Read only: A string representing the URI of the resource that was blocked because it violates a policy.
SecurityPolicyViolationEvent.columnNumber Read only: The column number in the document or worker at which the violation occurred.
SecurityPolicyViolationEvent.disposition Read only: A string indicating whether the user agent is configured to enforce or just report the policy violation.
SecurityPolicyViolationEvent.documentURI Read only: A string representing the URI of the document or worker in which the violation occurred.
SecurityPolicyViolationEvent.effectiveDirective Read only: A string representing the directive that was violated.
SecurityPolicyViolationEvent.lineNumber Read only: The line number in the document or worker at which the violation occurred.
SecurityPolicyViolationEvent.originalPolicy Read only: A string containing the policy whose enforcement caused the violation.
SecurityPolicyViolationEvent.referrer Read only: A string representing the URL for the referrer of the resources whose policy was violated, or null.
SecurityPolicyViolationEvent.sample Read only: A string representing a sample of the resource that caused the violation, usually the first 40 characters. This will only be populated if the resource is an inline script, event handler, or style — external resources causing a violation will not generate a sample.
SecurityPolicyViolationEvent.sourceFile Read only: If the violation occurred as a result of a script, this will be the URL of the script; otherwise, it will be null. Both columnNumber and lineNumber should have non-null values if this property is not null.
SecurityPolicyViolationEvent.statusCode Read only: A number representing the HTTP status code of the document or worker in which the violation occurred.
SecurityPolicyViolationEvent.violatedDirective Read only: A string representing the directive that was violated. This is a historical alias of effectiveDirective.

Examples

document.addEventListener("securitypolicyviolation", (e) => {
  console.log(e.blockedURI);
  console.log(e.violatedDirective);
  console.log(e.originalPolicy);
});

Specifications

Specification
Content Security Policy Level 3 # report-violation

Browser compatibility

desktop mobile
Chrome
Edge
Firefox
Opera
Safari
Chrome Android
Firefox for Android
Opera Android
Safari on iOS
Samsung Internet
WebView Android
WebView on iOS
SecurityPolicyViolationEvent
SecurityPolicyViolationEvent() constructor
blockedURI
columnNumber
disposition
documentURI
effectiveDirective
lineNumber
originalPolicy
referrer
sample
sourceFile
statusCode
violatedDirective
Available in workers