Roll Out CSP in Report-Only Mode
Added 2026-10
Roll Out CSP in Report-Only Mode — Chinese original prompt
站点要上线内容安全策略，但现有代码里有大量内联脚本和外部资源。请先用只报告模式收集 [观察周期] 内的违规，再分批收紧到正式拦截。输出：初始策略内容、违规日志的分类与处置方式、需要改造的内联脚本清单、切换到拦截模式的判断条件与回退方式。
Site original
Chinese original
Example
Sample input
站点要上线内容安全策略，但内联脚本很多，先用只报告模式收两周再收紧到拦截。
The output should include
- 给初始策略内容与报告地址
- 违规日志的分类与处置方式
- 切换拦截的判断条件与回退
Replace these placeholders 1
Swap the bracketed parts for your own details before sending.
[观察周期]
How to use
报告地址本身要限流，否则页面一多就把收集服务打挂。
Try tweaking it
- Have it restate requirements and constraints before writing code.
- Ask for the smallest change plus a rollback path, not a full-file rewrite.
What you should get
- A minimal, runnable change with copy-ready code
- Impact list: which files and call sites must follow
Common mistakes
- Asking it to touch ten files at once, then losing track of what broke what.
- Pasting only the error, with no code or version, and getting an unfixable answer.
How to check the output
- The change runs, can be rolled back, and touches nothing unrelated.
- Edge cases (empty, oversized, concurrent) are covered or explained.
Where it works
- Good for: having it restate requirements and constraints, then propose the smallest runnable change.
- Watch out: include versions and a minimal reproduction with the error, or the fix may look plausible but not fit.