Currently, I have implemented a Content Security Policy (CSP) in 'Content-Security-Policy-Report-Only' mode with a specified report-uri. There is an inline JavaScript code running on the page that the CSP restricts. My initial expectation was that while operating in report-only mode, the JavaScript would still execute but trigger a report to the specified report-uri link. Although the script is actually documented in the report-uri link, it prevents the page from loading and generates the following error in Chrome console: "[Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self'".". This situation raises the question of why the CSP restrictions are being enforced even when the policy is set to 'Report-only' mode. Your input on this matter would be greatly appreciated. Thank you.