HTML securitypolicyviolation DOM Event: Reference and Examples

When someone interacts with a webpage, the browser sends events to the relevant JavaScript code. The securitypolicyviolation event happens when the browser blocks or reports a Content Security Policy rule violation.

When securitypolicyviolation happens

The browser blocks or reports a Content Security Policy rule violation.

You can listen for it using addEventListener(). That keeps event handling separate from HTML attributes such as onclick and works well with modern code organization.

A small working example

<p id="demo-target">Select this sentence or inspect the page.</p>
<p id="event-status" role="status">Waiting for securitypolicyviolation...</p>
<script>
    const eventTarget = document;
    const eventStatus = document.getElementById("event-status");

    if (eventTarget) {
        eventTarget.addEventListener("securitypolicyviolation", (eventDetails) => {
            eventStatus.textContent = "securitypolicyviolation event received";
            console.log(eventDetails.type, eventDetails.target);
        });
    }
</script>

Reading the code

The browser listens for securitypolicyviolation on the relevant target. When the event occurs, the callback receives eventDetails, updates the status message and logs the event name and target in Developer Tools.

Configure a restrictive CSP response and attempt a blocked resource; inspect violation details carefully.

eventDetails.violatedDirective and blockedURI can help locate a CSP rule violation.

Some events need a specific browser condition, another tab or window, or a Web Component to reproduce. Read the trigger steps carefully before deciding that an event handler is not working.

Try it in your browser

Open the page, show the Console panel, and follow this test: Configure a restrictive CSP response and attempt a blocked resource; inspect violation details carefully. Then change one thing in the example and observe whether the event still fires.

Common Beginner Mistakes

• Expecting securitypolicyviolation to fire without its required user action or browser condition.
• Configure a restrictive CSP response and attempt a blocked resource; inspect violation details carefully.
• Adding repeated event listeners without considering cleanup or unwanted side effects.

Key Takeaways

• securitypolicyviolation reports the browser blocks or reports a Content Security Policy rule violation.
• addEventListener("securitypolicyviolation", ...) listens for the event on the appropriate target.
• Configure a restrictive CSP response and attempt a blocked resource; inspect violation details carefully.