Content-Security-Policy-Report-Only should show detailed CSP analysis

[groenroos]

What information was incorrect, unhelpful, or incomplete?

When a Content-Security-Policy-Report-Only header is defined, the "CSP analysis" tab is empty, with an "Implement an enforced policy" exception message.

e.g. https://developer.mozilla.org/en-US/observatory/analyze?host=google.com#csp

What did you expect to see?

As discussed in #5, while the flag and the -25 score is correct, the "CSP analysis" tab should still display the full line-by-line CSP analysis as though the header was enforced. This would help with iterating the CSP policy without causing disruption to users.

Do you have any supporting links, references, or citations?

• Sites sending Content-Security-Policy-Report-Only are reported as "No CSP headers detected" #5
• Example result: https://developer.mozilla.org/en-US/observatory/analyze?host=google.com#csp

Do you have anything more you want to share?

The discussion in the previous issue resolved to initially create the behaviour that currently exists, and follow up after launch with this described behaviour.

That issue was closed as completed when the first step was implemented (possibly because it satisfied the title of the initial issue?). However, displaying the full CSP analysis does not seem to be implemented yet, and so I thought I'd open a separate issue for that.

[github-actions]

It looks like this is your first issue. Welcome! 👋 One of the project maintainers will be with you as soon as possible. We appreciate your patience. To safeguard the health of the project, please take a moment to read our code of conduct.