Reporting API

Describe the problem

#5496 added CSP report-only mode. To use the report-to directive, it's necessary to add Report-To and Reporting-Endpoints headers inside handle (the latter is the newer API, but isn't universally supported yet, so both are necessary), which somewhat defeats the object of letting the framework handle CSP. In fact it's worse, since report-to isn't universally supported; you need to use the report-uri directive as well.

The whole thing is a shocking mess.

Describe the proposed solution

Copied from this comment:

Just spitballing:

export default {
  kit: {
    csp: {...},
    reporting: {
      'main-endpoint': {
        uri: '/reporting/main',
        maxage: 86400
      },
      default: {
        uri: '/reporting/default',
        maxage: 86400
      }
    }
  }
};

SvelteKit could then easily create the headers and report-to/report-uri directives and verify that the directives match the headers (i.e. the endpoints have been defined in reporting, and have a POST handler if they're implemented as SvelteKit endpoints).

Alternatives considered

Leave it as an exercise to readers. I think that would be a shame, since it's so finicky to set up, and we already have nice CSP handling.

Importance

nice to have

Additional Information

No response

Start by reviewing the CSP report-only work from #5496 and the existing CSP configuration and header generation. Compare the proposed reporting configuration with the Report-To, Reporting-Endpoints, report-to, and report-uri requirements. Done means SvelteKit can generate consistent headers and directives and validate configured endpoint handlers.