3

Issue

Many CSP validators like cspvalidator.org tell me that:

A draft of the next version of CSP deprecates report-uri in favour of a new report-to directive.

I found more information about this on wicg.github.io, but I didn't find an example / a solution.

Question

How do I properly implement the Report-To HTTP header in Apache 2?

This doesn't throw an error but also does not execute the linked script in Firefox 49 and Chrome 53:

Header set Report-To "{'url': 'https://website.com/csp-report.php', 'group': 'csp-endpoint', 'max-age': 10886400}"

With the Content-Security-Policy header implemented like this:

Header set Content-Security-Policy "default-src 'none'; report-to csp-endpoint"
3

There are examples in the draft of the Reporting-Endpoints directive:

Reporting-Endpoints = endpoint-1="https://example.com/reports"

Your rule is correctly created, as in it returns a valid JSON object, but since the Reporting API is still a draft, most UA haven't got around implementing it. You could simply have both, report-uri and Reporting-Endpoints header meanwhile if you want to.

0

It appears that report-to header has been replaced by a report-uri field in the CSP. Here is a document from the Mozilla Foundation that explains how to use the reporting functionality of content security policies: https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Using_CSP_violation_reports

It suggests putting the report URL directly into the CSP header like:

Content-Security-Policy: default-src 'self'; report-uri http://reportcollector.example.com/collector.cgi

It also has detailed information about the format and syntax of the reports so that you can implement them yourself.

2
  • 3
    I'm sorry, but that's exactly the opposite from what really happens. The report-to directive is new while report-uri is going to be deprecated. – dargmuesli Oct 24 '16 at 15:53
  • I haven't found any examples of how to use the separate header and browsers don't appear to support it. – Stephen Ostermiller Oct 24 '16 at 16:09
0

Here is one example implementation:

Content-Security-Policy: default-src 'none'; img-src 'self' report-to default

and then adding another Report-To response header:

Report-To: {"group":"default","max_age": 10886400,"endpoints":[{"url":"https://example.com/reporting.php"}],"include_subdomains":true}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.