---
description: How Microsoft Dynamics 365 Commerce supports Content Security Policy, including report-only mode and nonces, and how to report to Report URI.
---

# Dynamics 365 Commerce

Dynamics 365 Commerce turns CSP on by default for ecommerce sites and ships a default list of allowed sources for scripts, styles and API calls. Everything is managed from site builder rather than from headers you write yourself, and most sites will need to extend that default list before pages behave correctly.

## What Dynamics 365 Commerce gives you

- A **Content security policy** tab under **Site settings > Extensions** in site builder, with per-directive lists you add source URLs to.
- An **Enable report only mode** checkbox. The browser stops enforcing the policy and reports violations to the URI in the `report-uri` directive instead - exactly what you want for a first rollout.
- An **Enable Nonce** checkbox, which generates a unique nonce per script in the CSP header and blocks inline scripts other than those added through the inline script module.
- A **Disable content security policy** checkbox if you need to turn it off for a site entirely.
- Directive-level control over `script-src`, `style-src`, `connect-src`, `font-src`, `img-src`, `media-src`, `child-src`, `frame-src`, `frame-ancestors`, `object-src` and `report-uri`.

## Sending reports to Report URI

Add your URL to the `report-uri` directive on the **Content security policy** tab, then **Save and publish**. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    https://abc123.report-uri.com/r/d/csp/reportOnly

Turn on **Enable report only mode** at the same time so you are collecting reports without blocking anything, then switch to the `enforce` endpoint when you take report-only mode back off.

## Things to watch for

- CSP is on by default, so a site can be blocking resources before anyone has thought about a policy. If pages are half-broken after a deployment, check this tab before anything else.
- `eval()` is blocked by default. Adding `'unsafe-eval'` to `script-src` fixes it, but it is a real weakening of the policy - prefer removing the dependency on `eval()`.
- Page mocks used with the online SDK do not inherit the platform's default policies when you define `contentSecurityPolicy` in `appContext`, so a mock is not a reliable preview of production behaviour.

## Official documentation

[Microsoft - Manage Content Security Policy (CSP)](https://learn.microsoft.com/en-us/dynamics365/commerce/manage-csp)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)