# Diagnose: Content Security Policy blocking the Sentry SDK
## The symptom
The browser console shows CSP violations mentioning the ingest host or a worker, and events, replays, or both stop arriving. Everything works with CSP in report-only mode and breaks in enforce mode.
## What the SDK needs
- `connect-src`: the ingest host (`[org].ingest.sentry.io`), or your tunnel path if you use `tunnelRoute`. With a tunnel, the browser only talks to your own domain, so allow the tunnel path instead of the Sentry host.
- `worker-src` / `child-src`: the replay integration records via a worker. A strict worker directive without the SDK's origin kills replay silently while errors keep flowing.
- `script-src`: only relevant if you load the SDK from the CDN or the loader snippet rather than bundling it.
## Confirmation
Open devtools, reproduce, and read the violated directive in the console message. It names exactly what to allow. `connect-src` violations mean events are blocked; `worker-src` violations with working errors mean replay specifically is blocked.
## Fix
Add the narrowest allowance that clears the violation:
```
connect-src 'self' https://YOUR-ORG.ingest.sentry.io;
```
Prefer the tunnel route where possible: one first-party path to allow, no third-party host in the policy, and adblocker resistance as a bonus.
## Verify
With CSP enforcing, trigger an error and a replay session in a clean browser profile and confirm both arrive. Keep CSP in report-only mode for a deploy cycle first if the policy is hand-maintained; a typo in the header breaks the SDK the same way a missing directive does.