Diagnose Content Security Policy errors without disabling protection
Use this guide when the consent script or declaration fails and the browser reports a Content Security Policy (CSP) violation.
1. Reproduce the failure on an authorized test page
Record the blocked resource, violated directive and whether the message comes from an enforced or report-only policy.
2. Check the response headers and any CSP meta element
Multiple policies can apply at the same time; permitting a resource in only one policy may not resolve the block.
3. Identify the resource’s role before changing policy
The verified main script is served from https://cdn.passiro.com/passiro.js. This is not a complete list of every origin or directive needed by every configuration.
4. Ask the website’s policy owner to make the smallest justified change in staging
Do not solve the issue by removing CSP or adding broad wildcard, unsafe-inline or unsafe-eval exceptions.
5. Reload and test the script, declaration and all consent scenarios
Review newly revealed violations individually.
Expected result: the intended resources load under the enforced policy and consent behavior still passes. If another resource is blocked, identify its purpose and repeat the same targeted review.