---
description: The Content Security Policy exceptions the New Relic browser agent requires, and how to send CSP violation reports to Report URI.
---

# New Relic

The New Relic browser agent is installed as an inline script, which means the documented configuration asks you to add `'unsafe-inline'` to your policy. That is worth being deliberate about: a monitoring agent should not be the reason your CSP stops protecting you against script injection.

Newer agent versions give you better options, so the version you are running matters here more than usual.

## What New Relic requires

The documented CSP exceptions, addable to `script-src` and `connect-src` or to the `default-src` fallback:

- `'unsafe-inline'` - required because the agent is installed via an inline script
- `https://js-agent.newrelic.com` - where the agent's additional script files are hosted
- `*.nr-data.net` - where the agent sends payloads; subdomains vary by account type, and individual subdomains can be listed instead if the wildcard is too broad

Two things reduce the damage:

- From agent **1.240.0**, the agent can proxy its network requests through a domain and path you control, which can remove the need for New Relic domains in `script-src` and `connect-src` altogether.
- From agent **1.247.0**, additional JavaScript the agent loads carries a SHA512 integrity hash, and the agent respects a `nonce` present on page scripts - so a stricter policy becomes workable.

## Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the [Setup](https://report-uri.com/account/setup/) page:

    Content-Security-Policy-Report-Only: script-src 'self' https://js-agent.newrelic.com; connect-src 'self' *.nr-data.net; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

## Things to watch for

- **`'unsafe-inline'` in `script-src` disables the main protection a CSP gives you.** If you are on 1.247.0 or later, use the nonce support instead. If you are below it, upgrading the agent is a security change, not just a maintenance one.
- Note that in a nonce-based policy, browsers that understand nonces ignore `'unsafe-inline'` - so leaving it in place alongside a nonce is a fallback for older browsers, not the working configuration.
- The proxy option is the strongest answer if your requirements do not allow third-party script or connect origins at all. It moves the traffic to a domain you control rather than allowlisting New Relic's.

## Official documentation

[New Relic - Compatibility and requirements for browser monitoring](https://docs.newrelic.com/docs/browser/new-relic-browser/getting-started/compatibility-requirements-browser-monitoring/)

## Start Monitoring with Report URI

**Already using us for CSP?** Find your report-uri value on [Setup](https://report-uri.com/account/setup/), or view your [CSP reports](https://report-uri.com/account/reports/csp/).

**New to Report URI?** Create an account and grab your report-uri value from the [Setup](https://report-uri.com/account/setup/) page.

[Start your free trial](https://report-uri.com/register/?plan=starter2025)