qa.sagarvachhani.com

Violation class: scripted network connections. Every violation here is a connection opened by script rather than a resource declared in markup, so they all report as connect-src. This is the class most likely to be missed by a collector that only models document subresources, which is why it gets a host of its own.

Expected reports (4), all connect-src:

• fetch() to a cross-origin URL
• XMLHttpRequest to a cross-origin URL
• WebSocket to a cross-origin wss:// URL
• navigator.sendBeacon() to a cross-origin URL

Note the WebSocket case: its blocked-uri carries a wss: scheme, which is worth confirming the pipeline stores rather than discarding as malformed.

Outcomes (Report-Only, so each connection is still attempted and will fail on its own merits — a failure here is not the CSP):

• fetch: pending
• XHR: pending
• WebSocket: pending
• sendBeacon: pending

back to index