Skip to content
100% local

CSP violation report parser

Turn pasted CSP violation reports into a readable summary of which directives and sources are blocked.

Input
Output

CSP violation report parser

Paste the JSON your CSP report-uri endpoint or Reporting API collector received and this tool turns a wall of violation reports into a summary you can actually read: which directives are being blocked, and which sources are triggering them. It is built for developers rolling out or tightening a Content-Security-Policy, who need to see the pattern across dozens or hundreds of reports rather than reading them one at a time.

Group by directive to see which policy sections fire most, or group by blocked source to find the one script or stylesheet causing most of the noise. Hide reports from browser extensions — Chrome and Firefox send csp-report bodies with a chrome-extension: or moz-extension: blocked-uri whenever an installed extension trips the page's policy, which has nothing to do with your own code. Turn on affected pages to see every document URL a violation was seen on. Switch the output to suggested rules and the tool proposes the source-list additions — origins, 'unsafe-inline', data: — that would let each blocked directive through, as a starting point for widening the policy.

The parser accepts a JSON array, a single report object, or one report per line, and understands both the classic {"csp-report": {...}} POST body and the newer Reporting API {"type", "body"} envelope, so raw server logs paste in without reformatting. Reports that don't parse are skipped rather than failing the batch, and the tally shows how many reports came in, how many groups they collapsed into, and how many extension reports were filtered out.

Everything runs in your browser. The pasted reports are never uploaded anywhere, which matters since they can include internal URLs and page structure. Copy the summary, download it as a .txt file, or send it to the input of another tool to keep working.

FAQ

Which report formats does it understand?
Both shapes browsers send: the classic report-uri POST body wrapped in "csp-report", and the newer Reporting API envelope with a "body" field. It also accepts a bare report object with no wrapper, and either a JSON array or one report per line.
What's the difference between grouping by directive and by source?
Grouping by directive shows which policy sections (script-src, style-src…) are firing most; grouping by blocked source shows which script, stylesheet or other resource is causing the most violations across directives.
Why are some reports hidden by default?
Reports whose blocked-uri starts with chrome-extension: or moz-extension: come from a browser extension tripping the page's policy, not from your own code. Hiding them is on by default; turn it off to see everything.
How are the suggested rules calculated?
For each directive, the tool collects every distinct blocked source seen and reduces it to a CSP source expression — an origin for a URL, 'unsafe-inline' for inline scripts or styles, 'unsafe-eval' for eval, data: for data URIs — then lists them as a starting point, not a policy to paste in unreviewed.
Is my report data uploaded anywhere?
No. Parsing happens entirely in your browser — the pasted reports never leave your device.