Spam avoidance mechanism

In today's WebPerf WG call, @yoavweiss asked about how we can tell apart valid report uploads from fake ones. We should figure out how to prevent a spam problem like you get with (for instance) Google Analytics: right now, anyone can get the report upload instructions for a particular origin (just GET any page on that domain and look at the Report-To response header), and can then blast away uploading any number of bogus reports about that origin.

You could solve that right now by handing out custom upload URLs for different clients; the server receiving reports would verify that the URL that the report came in on matches what would've been handed out to the client uploading the report. We also briefly discussed adding this more directly as part of the spec proper — each endpoint group in a Report-To header, for instance, could include a nonce field, whose value is different for each client, and each report upload would include that nonce value as-is, so that the server could verify it. That would give you the same capability without having to add complexity to your DNS or URL routing configurations.