Support Integrity Policy violation reports

Sentry’s Security Header endpoint accepts Reporting API payloads, but Relay currently classifies only legacy CSP reports and Reporting API reports with type: "csp-violation". Reports with type: "integrity-violation" are rejected as unsupported.

• Integrity-Policy and Integrity-Policy-Report-Only produce integrity-violation reports containing documentURL, blockedURL, destination, and reportOnly: https://developer.mozilla.org/en-US/docs/Web/API/IntegrityViolationReport
• Current Sentry documentation describes CSP reporting only: https://docs.sentry.io/platforms/javascript/security-policy-reporting/
• Relay’s classifier has only Csp and Unsupported report types: https://github.com/getsentry/relay/blob/master/relay-event-schema/src/protocol/security_report.rs

This prevents projects expanding Subresource Integrity coverage from ingesting, grouping, and surfacing policy violations in Sentry.

via ADV.

--

View Junior Session [Sentry]

Start in relay-event-schema/src/protocol/security_report.rs and compare the existing Csp and Unsupported classification paths. Review the linked Sentry security policy reporting documentation and trace how accepted reports are ingested, grouped, and surfaced. Done means integrity-violation reports containing the listed fields are accepted and documented alongside CSP reports.