Detect CSP violations with javascript

Question

Is it possible to detect a Content Security Policy violation with javascript?

My CSP works and sends its reports, where I see that some urls are injected, probably by browser addons. I would like to display a hint to the user, that some addon tries to modify the page.

Can I somehow detect the aborted connection with javascript (which is itself whitelisted in the CSP of course)?

Answer 1

According to the W3C CSP specification, a violation triggers a securitypolicyviolation event. You can add an event listener for this.

document.addEventListener("securitypolicyviolation", function(e) {
    alert("Something is trying something bad!");
});

See the above link for the properties of this event.

In Firefox Release, you need to enable the security.csp.enable_violation_events preference to enable this feature. See Experimental Features in Firefox documentation.