Can Content-Security-Policy and Content-Security-Policy-Report-Only headers coexist without interfering with each other

Question

I am working on addition of Content-Security-Policy-Report-Only header to my company's website. While I was researching on it, I found that a few of the pages already have Content-Security-Policy header set. I investigated further and found that the directives are not required. Also, default directive used for those pages is 'self' whereas what I am planning to set for report-only is 'https:'

I am not an expert in this area and want to make sure that both header values don't interfere. Hence looking for guidance

If I set report-only for the pages that already has CSP header, is it going to interfere with existing headers? Is the behavior browser dependent?

Any help/pointers will be helpful in deciding.

Thanks!

Answer 1

Content-Security-Policy and Content-Security-Policy-Report-Only have no effect on each other and are entirely independent. Setting both is a common practice when tightening policies. I wouldn't doubt that there has been a bug around this behavior at some point, but the spec is clear.

Answer 2

From Section 5 of the CSP2 Spec

A server MAY cause user agents to monitor one policy while enforcing another policy by returning both Content-Security-Policy and Content-Security-Policy-Report-Only header fields. For example, if a server operator may wish to enforce one policy but experiment with a stricter policy, she can monitor the stricter policy while enforcing the original policy. Once the server operator is satisfied that the stricter policy does not break the web application, the server operator can start enforcing the stricter policy.