CSP blocks required script: pre-release and first 30 minutes checklists

A Content Security Policy change blocks a script the page needs.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

7 pre-release items · 7 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Reload the single-page app at least 50 times in a real browser against the release candidate and confirm every load renders the app shell with no CSP violation in the console. e2e
PR-02Click the OAuth login button on the /login/ page of the release candidate in a real browser and confirm the identity provider redirect starts. e2e
PR-03Fetch the rendered HTML repeatedly and confirm the nonce attribute on every script tag matches the nonce in the Content-Security-Policy header of the same response. security
PR-04Generate 10,000 nonces and confirm every value uses URL-safe unpadded base64 with no + or / characters. security
PR-05Search the templates of every page, including login pages shipped by framework dependencies, for inline event handlers such as onclick and confirm none remain under a strict script-src policy. security
PR-06When an upgrade turns on a CSP for the first time, diff the Content-Security-Policy header against the previous release and list every inline script the new policy must allow. security
PR-07Add a browser-based synthetic check that loads the app shell and the login page after deploy and fails on any CSP violation report. synthetic

First 30 minutes

FM-01Open the app in a browser, reload it several times and read the console for Content Security Policy errors.
FM-02Compare the nonce in the Content-Security-Policy response header with the nonce attribute in the rendered HTML of the same response.
FM-03Do not treat passing health and API checks as proof the release works, because both stayed green while users saw a blank page.
FM-04Roll back to the last release that served a working page if the CSP change shipped with the upgrade.
FM-05If rollback is not possible, relax the script-src directive for the blocked inline script as a temporary workaround and record the change.
FM-06Tell users that a blank page or a dead login button is a known fault and give the expected fix time.
FM-07Before redeploying the fix, confirm in a browser that the blocked script now runs on repeated reloads.

Download the checklist

Pre-release checklist (Markdown)1.6 KB · v1.0.0
First 30 minutes checklist (Markdown)1.1 KB · v1.0.0

Only in this checklist

PR-03 is the only item among 6 published checklists in this group that relies on security tests: Fetch the rendered HTML repeatedly and confirm the nonce attribute on every script tag matches the nonce in the Content-Security-Policy header of the same response.

Questions

What should be checked before a release to prevent CSP blocks required script?

7 pre-release items, PR-01 to PR-07. PR-01: Reload the single-page app at least 50 times in a real browser against the release candidate and confirm every load renders the app shell with no CSP violation in the console.

Is there a rollback plan for CSP blocks required script?

The first-30-minutes checklist has 7 items. FM-01: Open the app in a browser, reload it several times and read the console for Content Security Policy errors.

What should a team do in the first 30 minutes after CSP blocks required script is detected?

The first-30-minutes checklist has 7 items. FM-01: Open the app in a browser, reload it several times and read the console for Content Security Policy errors.

Is a CSP blocks required script checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: end-to-end tests, security tests and synthetic monitoring.

Which pipeline stages does the CSP blocks required script checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.

In what formats can the CSP blocks required script checklist be downloaded?

Both checklists download as Markdown files: /downloads/csp-blocks-required-script-pre-release.md and /downloads/csp-blocks-required-script-first-30-minutes.md, licensed CC BY 4.0.