Diagnose: Content Security Policy blocking the Sentry SDK

TL;DR

Add the narrowest allowance that clears the violation: ` connect-src 'self' https://YOUR-ORG.ingest.sentry.io; ` Prefer the tunnel route where possible: one first-party path to allow, no third-party host in the policy, and adblocker resistance as a bonus. With a tunnel, the browser only talks to your own domain, so allow the tunnel path instead of the Sentry host. - worker-src / child-src: the replay integration records via a worker.

When to use

You are seeing this: The browser console shows CSP violations mentioning the ingest host or a worker, and events, replays, or both stop arriving. Use this skill when you run into "Diagnose: Content Security Policy blocking the Sentry SDK".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

The symptom

The browser console shows CSP violations mentioning the ingest host or a worker, and events, replays, or both stop arriving. Everything works with CSP in report-only mode and breaks in enforce mode.

What the SDK needs

• connect-src: the ingest host ([org].ingest.sentry.io), or your tunnel path if you use tunnelRoute. With a tunnel, the browser only talks to your own domain, so allow the tunnel path instead of the Sentry host.
• worker-src / child-src: the replay integration records via a worker. A strict worker directive without the SDK's origin kills replay silently while errors keep flowing.
• script-src: only relevant if you load the SDK from the CDN or the loader snippet rather than bundling it.

Confirmation

Open devtools, reproduce, and read the violated directive in the console message. It names exactly what to allow. connect-src violations mean events are blocked; worker-src violations with working errors mean replay specifically is blocked.

Fix

Add the narrowest allowance that clears the violation:

connect-src 'self' https://YOUR-ORG.ingest.sentry.io;

Prefer the tunnel route where possible: one first-party path to allow, no third-party host in the policy, and adblocker resistance as a bonus.

Verify

With CSP enforcing, trigger an error and a replay session in a clean browser profile and confirm both arrive. Keep CSP in report-only mode for a deploy cycle first if the policy is hand-maintained; a typo in the header breaks the SDK the same way a missing directive does.

Researched against live Sentry docs 2026-09-26. The Next.js guide (docs.sentry.io/platforms/javascript/guides/nextjs/) documents tunnelRoute /sentry-tunnel routing events through the first-party server. The JS session replay page (docs.sentry.io/platforms/javascript/session-replay/) documents the replay integration and its worker-based recording. The JS filtering page (docs.sentry.io/platforms/javascript/configuration/filtering/) documents allowUrls/denyUrls semantics.