Skip to content
MDView as Markdown

New Relic

The New Relic browser agent is installed as an inline script, which means the documented configuration asks you to add 'unsafe-inline' to your policy. That is worth being deliberate about: a monitoring agent should not be the reason your CSP stops protecting you against script injection.

Newer agent versions give you better options, so the version you are running matters here more than usual.

What New Relic requires

The documented CSP exceptions, addable to script-src and connect-src or to the default-src fallback:

  • 'unsafe-inline' - required because the agent is installed via an inline script
  • https://js-agent.newrelic.com - where the agent's additional script files are hosted
  • *.nr-data.net - where the agent sends payloads; subdomains vary by account type, and individual subdomains can be listed instead if the wildcard is too broad

Two things reduce the damage:

  • From agent 1.240.0, the agent can proxy its network requests through a domain and path you control, which can remove the need for New Relic domains in script-src and connect-src altogether.
  • From agent 1.247.0, additional JavaScript the agent loads carries a SHA512 integrity hash, and the agent respects a nonce present on page scripts - so a stricter policy becomes workable.

Sending reports to Report URI

Add a reporting directive to your policy. Your URL comes from the Setup page:

Content-Security-Policy-Report-Only: script-src 'self' https://js-agent.newrelic.com; connect-src 'self' *.nr-data.net; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly

Things to watch for

  • 'unsafe-inline' in script-src disables the main protection a CSP gives you. If you are on 1.247.0 or later, use the nonce support instead. If you are below it, upgrading the agent is a security change, not just a maintenance one.
  • Note that in a nonce-based policy, browsers that understand nonces ignore 'unsafe-inline' - so leaving it in place alongside a nonce is a fallback for older browsers, not the working configuration.
  • The proxy option is the strongest answer if your requirements do not allow third-party script or connect origins at all. It moves the traffic to a domain you control rather than allowlisting New Relic's.

Official documentation

New Relic - Compatibility and requirements for browser monitoring

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page.

Start your free trial