report-sha256 keyword

The 'report-sha256', 'report-sha384', and 'report-sha512' keywords ask the browser to compute and report a hash of each inline and external script it loads, without blocking anything. Unlike a normal hash source, which allows a script whose digest you already know, these report-only keywords flip the direction: the browser tells you what it ran by emitting a csp-hash report. That is the mechanism behind the CentralCSP script inventory and SBOM.

A report-only collection policy, as you would ship it:

Content-Security-Policy-Report-Only:
    script-src 'report-sha256';
    report-to csp-endpoint

Syntax

Each keyword is a single-quoted token placed in a script directive, usually script-src, and is meant for the Report-Only header so it never affects enforcement.

The number names the digest algorithm: 'report-sha256', 'report-sha384', or 'report-sha512'. The browser hashes each script with that algorithm and includes the result in a report.

What it does

When a directive contains a 'report-sha...' keyword, the browser computes the digest of every script it loads under that directive and sends a csp-hash report for each one to the configured endpoint. It does not change whether the script runs; collection is the only effect. Over time the stream of reports describes every script that actually executed on real page loads, inline and external, including ones added by third-party tags at runtime.

Reporting-Endpoints: csp-endpoint="https://<Endpoint-ID>.report.centralcsp.com"

The csp-hash report

The browser delivers these through the Reporting API as reports of type csp-hash. Each report carries the script's hash and enough context to identify the resource. The keyword and the report are in the CSP3 editor's draft, but no second engine has implemented them yet, so the details could still evolve before multi-vendor agreement.

This is what powers a script inventory: by matching reported hashes against known libraries, CentralCSP builds a software bill of materials (SBOM) for each page, detects the technology and version behind each script, and flags known CVEs, without you maintaining a hash allowlist by hand.

What it protects against

On its own the keyword enforces nothing; its value is visibility. Knowing exactly which scripts run on a page, especially the third-party and dynamically injected ones a manual review misses, is the input to detecting an unexpected or tampered script, which is the client-side change-detection problem behind PCI DSS v4 requirements 6.4.3 and 11.6.1. CentralCSP uses that signal for script monitoring and alerting.

Known limitations

This is a reporting aid, not a control: it cannot block a malicious script, only report that one ran. Because it is Chromium-only, the inventory it produces reflects Chromium users; Firefox and Safari visitors generate no csp-hash reports. Pair it with an enforcing policy (nonces, hashes, 'strict-dynamic') for actual protection.

Risks

The reporting volume can be high on script-heavy pages, since every script load produces a report; sample or aggregate at the endpoint rather than storing each one raw. Do not mistake report coverage for enforcement: a page can be fully inventoried and still allow inline injection if the enforced policy is weak.

Examples

Collect script hashes in report-only mode while an enforcing policy runs separately:

Content-Security-Policy: script-src 'self' 'nonce-r4nd0m' 'strict-dynamic'

Content-Security-Policy-Report-Only:
    script-src 'report-sha256';
    report-to csp-endpoint

Recommendation

Add 'report-sha256' to script-src in a Report-Only policy, next to your enforced policy, so hash collection never affects what runs.

Content-Security-Policy-Report-Only:
    script-src 'report-sha256';
    report-to csp-endpoint

The report stream gives you a continuous inventory of every script that actually executes on real page loads, which is what the CentralCSP script inventory and SBOM is built from. It costs nothing in enforcement and works today for your Chromium traffic.

Browser support

Stable in Chromium-based browsers (Chrome, Edge), enabled by default, on desktop, Android, and WebView. Not an origin trial: a separate origin trial covers a different feature, URL and eval hashes in script-src. Firefox and Safari have not implemented the keywords or signaled support. The keywords are in the CSP3 editor's draft grammar, so they are on a standards track but not yet a multi-vendor standard.

See also

• Hashes and nonces
• Keywords
• Report-Only header
• script-src directive
• csp-hash report
• The CSP report-sha keywords explained

Sources

• W3C, Content Security Policy Level 3, hash sources
• MDN, Content-Security-Policy
• Chrome, Content security policy
• Chrome Platform Status, hash reporting for scripts
• Chrome blog, hashes in script-src