# CSP blocks required script: pre-release checklist

Source: https://releasefailures.com/incidents/csp-blocks-required-script/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A Content Security Policy change blocks a script the page needs.
- [ ] PR-01 Reload the single-page app at least 50 times in a real browser against the release candidate and confirm every load renders the app shell with no CSP violation in the console. (test class: End-to-end tests)
- [ ] PR-02 Click the OAuth login button on the /login/ page of the release candidate in a real browser and confirm the identity provider redirect starts. (test class: End-to-end tests)
- [ ] PR-03 Fetch the rendered HTML repeatedly and confirm the nonce attribute on every script tag matches the nonce in the Content-Security-Policy header of the same response. (test class: Security tests)
- [ ] PR-04 Generate 10,000 nonces and confirm every value uses URL-safe unpadded base64 with no + or / characters. (test class: Security tests)
- [ ] PR-05 Search the templates of every page, including login pages shipped by framework dependencies, for inline event handlers such as onclick and confirm none remain under a strict script-src policy. (test class: Security tests)
- [ ] PR-06 When an upgrade turns on a CSP for the first time, diff the Content-Security-Policy header against the previous release and list every inline script the new policy must allow. (test class: Security tests)
- [ ] PR-07 Add a browser-based synthetic check that loads the app shell and the login page after deploy and fails on any CSP violation report. (test class: Synthetic monitoring)