{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "csp-report-only-widget-inventory",
  "group": "embed",
  "title": [
    "Scope a CSP trial before approving a new widget",
    "新增组件前，先界定CSP试验范围"
  ],
  "intro": [
    "A merchant adding chat, maps or analytics should know which resources the widget needs before accepting broad script permissions. Commission an inventory and an isolated report-only trial. Preserve the current enforced policy while security owners assess the evidence.",
    "商家增加聊天、地图或分析组件前，应先知道组件真正需要哪些资源，再考虑权限范围。可委托盘点及隔离的report-only试验，评估时保留当前强制策略。"
  ],
  "facts": [
    [
      "MDN explains that Content-Security-Policy-Report-Only monitors without enforcing the candidate policy and is an HTTP response header, not a meta setting.",
      "MDN说明Content-Security-Policy-Report-Only观察候选策略但不强制执行，且必须通过HTTP响应头设置，不能靠meta。",
      "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy-Report-Only"
    ]
  ],
  "columns": [
    [
      "Synthetic observation",
      "Interpretation",
      "Review action"
    ],
    [
      "合成观察",
      "解释",
      "复核动作"
    ]
  ],
  "example": [
    [
      [
        "script-src report for chat.example.test",
        "Candidate script origin missing",
        "Identify vendor/owner; do not allow all HTTPS"
      ],
      [
        "聊天测试域出现script-src报告",
        "候选脚本来源未列入",
        "确认供应商及负责人，不能放开全部HTTPS"
      ]
    ],
    [
      [
        "connect-src report for metrics.example.test",
        "Network endpoint differs from script host",
        "Review data purpose and exact endpoint"
      ],
      [
        "分析测试域出现connect-src报告",
        "连接目标与脚本域不同",
        "复核数据用途及准确目标"
      ]
    ],
    [
      [
        "Widget works; report-only violations exist",
        "Candidate policy is not enforced",
        "Working UI is not enforcement proof"
      ],
      [
        "组件能用，但有report-only违规",
        "候选策略并未强制执行",
        "界面能用不证明强制策略兼容"
      ]
    ],
    [
      [
        "No reports received",
        "Collector/coverage unknown",
        "Verify reporting endpoint and browser support"
      ],
      [
        "没有收到报告",
        "收集器或覆盖未知",
        "先核对上报端点和浏览器支持"
      ]
    ]
  ],
  "steps": [
    [
      "Inventory scripts, frames, images and connections on an authorised isolated copy. Record which business function owns each origin and whether any personal data is transmitted.",
      "在获准隔离副本盘点脚本、框架、图像及连接，记录每个来源的功能归属及是否传输个人资料。"
    ],
    [
      "Security staff define the candidate header and reporting destination, with access controls and redaction. Do not replace an enforced policy with report-only to make a widget work.",
      "安全人员确定候选响应头及报告接收端，限制访问并脱敏；不能把强制策略换成report-only来让组件运行。"
    ],
    [
      "Exercise allowed journeys and blocked-resource cases on the supported browser set. Review reports with real functionality, then seek separate approval for any production policy change.",
      "在支持的浏览器演练正常流程及资源阻塞，把报告与真实功能对照；生产策略变更另行批准。"
    ]
  ],
  "result": [
    "The inventory can distinguish a missing script origin from a missing network endpoint. The supplier should produce a narrow candidate policy and unresolved dependencies, not promise that zero reports means a secure site. Report-only is a learning stage with its own collection failure modes.",
    "盘点能区分脚本来源缺失与连接目标缺失。供应商应交付范围准确的候选策略及未明依赖，不能承诺“零报告就是安全”。report-only是取证阶段，报告收集本身也可能失败。"
  ],
  "accept": [
    "A usable trial receipt names the existing enforced policy, candidate policy, tested journeys, report collector and unresolved violations. Successful page loading alone is insufficient.",
    "试验回执须列原强制策略、候选策略、已测流程、收集端及未解决违规；页面能打开不够。"
  ],
  "limit": [
    "Synthetic observations; no CSP header or security setting on MadRaven or another production site was changed. Reports can contain sensitive URLs; actual collection requires the owner’s approved data controls.",
    "仅为合成观察；没有修改MadRaven或其他生产站的CSP及安全设置。报告可能含敏感网址，真实收集须遵循负责人批准的数据控制。"
  ]
}