`Content-Security-Policy-Report-Only` should show detailed CSP analysis

What information was incorrect, unhelpful, or incomplete?

When a Content-Security-Policy-Report-Only header is defined, the "CSP analysis" tab is empty, with an "Implement an enforced policy" exception message.

e.g. https://developer.mozilla.org/en-US/observatory/analyze?host=google.com#csp

What did you expect to see?

As discussed in #5, while the flag and the -25 score is correct, the "CSP analysis" tab should still display the full line-by-line CSP analysis as though the header was enforced. This would help with iterating the CSP policy without causing disruption to users.

Do you have any supporting links, references, or citations?

• #5
• Example result: https://developer.mozilla.org/en-US/observatory/analyze?host=google.com#csp

Do you have anything more you want to share?

The discussion in the previous issue resolved to initially create the behaviour that currently exists, and follow up after launch with this described behaviour.

That issue was closed as completed when the first step was implemented (possibly because it satisfied the title of the initial issue?). However, displaying the full CSP analysis does not seem to be implemented yet, and so I thought I'd open a separate issue for that.

Start by tracing how the CSP analysis tab handles Content-Security-Policy-Report-Only responses and compare that path with enforced policies. Done means the tab shows the full line-by-line analysis as if the policy were enforced, while retaining the existing flag and -25 score; use the linked example and issue #5 to verify the behavior.