---
title: "Using Tealium for Content Security Policy (CSP) Reporting"
id: "95755"
type: "solution"
slug: "using-tealium-for-content-security-policy-csp-reporting"
published_at: "2026-08-10T20:31:39+00:00"
modified_at: "2026-08-10T20:32:44+00:00"
url: "https://tealium.com/developer-center/using-tealium-for-content-security-policy-csp-reporting/"
markdown_url: "https://tealium.com/developer-center/using-tealium-for-content-security-policy-csp-reporting.md"
taxonomy_solutions_department:
  - "Data & Analytics"
  - "IT"
taxonomy_solutions_usecase:
  - "Data Collection"
  - "Data Enrichment"
---

Data & Analytics

# Using Tealium for Content Security Policy (CSP) Reporting

Caleb Jaquith

Turning the same first-party reverse proxy into a first-party CSP violation reporting pipeline.

This post assumes you’ve already read [Part 1](https://tealium.com/developer-center/reduce-consent-fatigue-and-improve-compliance/)
 and Part 2 above — go catch up if you haven’t.

Content Security Policy (CSP) is a security standard that helps prevent cross-site scripting (XSS) and data injection attacks. It uses HTTP headers — primarily `Content-Security-Policy` — to control which resources (scripts, styles, images, and so on) a browser is allowed to load, and to report on URLs that violate the policy. This effectively blocks malicious injections when correctly defined.

We set out to see what it would take to set up CSP enforcement and reporting using Tealium and our new first-party reverse proxy, as a POC. It turned out to be straightforward — we added an Advanced HTTP API endpoint that flattens the report’s nested objects down to a flat set of attributes, and sent all of it to EventDB so we could report on it however we wanted.

## Routing reports through the proxy

All it took was this conditional redirect in the Worker function to make `https://calebjaquith.com/fwd-csp-reports/report` operational as a first-party redirect to our Advanced HTTP API endpoint:

```
Worker routingif (dir === 'csp-reports') {
  remote = "https://collect-eu-central-1.tealiumiq.com/integration/event/services-caleb/csp-violations/iuxe4s"
}
```

## Setting the CSP header itself

We added the CSP header in the same Worker from Posts 1 and 2 of this series, by setting the headers:

```
Worker header injection// Create a new Headers object to modify response headers
const newHeaders = new Headers(response.headers);
 
// Reuse previously sent Content-Security-Policy
if (originalResponse.status !== 304) {
  // 'strict-dynamic' removes the need for nonce propagation
  newHeaders.set("content-security-policy",
    `default-src 'self'; style-src https://calebjaquith.com 'unsafe-inline'; img-src https://calebjaquith.com https://*.cdninstagram.com data:; script-src 'nonce-${nonce}' 'unsafe-eval' 'strict-dynamic'; report-uri https://calebjaquith.com/fwd-csp-reports/report;`);
  newHeaders.set("content-security-policy-report-only",
    `default-src 'self' https://*.usercentrics.eu; style-src https://calebjaquith.com 'unsafe-inline'; img-src https://calebjaquith.com https://*.cdninstagram.com data:; script-src 'nonce-${nonce}' 'unsafe-eval' 'strict-dynamic'; report-uri https://calebjaquith.com/fwd-csp-reports/report;`);
}
```

That setup lets us flexibly adapt the policy as needed, and lets us use **EventStream** to send those events elsewhere or **EventDB** to store them for reporting — which can also plug into **Insights**.

Start the series

#### Read Part 1: Reduce Consent Fatigue and Improve Compliance

[Read Part 1 →](https://tealium.com/developer-center/build-first-party-durability-with-cloudflare-workers/)

Caleb Jaquith

**Senior Product Manager**  
*Data Privacy Products / Visitor & Identity Platform*  
  
 I'm a Berlin-based American who joined Tealium in the summer of 2016, originally working on enterprise Tealium deployments as a (Lead) Implementation Engineer.   
  
 Since the fall of 2021, I've been the (Senior) Product Manager for Data Privacy Products at Tealium, working with the team to help our customers ensure data only flows where it's allowed to flow. In late 2024, I started working with the Visitor & Identity Platform team as well.   
  
 Say it "KAY-leb JAKE-with".

### Use Case

Data Collection

Data Enrichment

### Products