http.headers.Content-Security-Policy.report-to - Does not work in Chromium
Nobody has claimed this yet.
- Dominant language
- JSON
- Stars
- 5.8k
- Forks
- 2.6k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 186
Description
What type of issue is this?
Browser bug (a bug with a feature that may impact site compatibility)
What information was incorrect, unhelpful, or incomplete?
The report indicates support in Chrome and Edge for report-to, but as noted in https://bugs.chromium.org/p/chromium/issues/detail?id=1098885, this is does not actually send the report data. It was reported in Chrome 83 and does not seem to have been fixed since.
What browsers does this problem apply to, if applicable?
Chromium (Chrome, Edge 79+, Opera, Samsung Internet)
What did you expect to see?
I expected to receive a report, but did not unless I removed the report-to directive.
Did you test this? If so, how?
Yes, my site was using report-to, and I did not see logs in Chrome, which led me to the Chromium bug.
Can you link to any release notes, bugs, pull requests, or MDN pages related to this?
https://bugs.chromium.org/p/chromium/issues/detail?id=1098885
https://bugs.chromium.org/p/chromium/issues/detail?id=1152867
Do you have anything more you want to share?
It might be helpful to not mark report-uri as deprecated, since it is the only working way to get CSP reports, given that report-to is not supported in any browsers.
MDN URL
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to
MDN metadata
MDN page report details
- Query:
http.headers.Content-Security-Policy.report-to - Report started: 2022-10-28T21:34:10.417Z
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the browser compatibility data entry for the MDN page http.headers.Content-Security-Policy.report-to, then review the linked Chromium issues and the report details in this issue. Update the compatibility data to reflect the documented Chromium behavior and check that the related report-uri guidance is consistent with current support evidence.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- json
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 64/100