Repository navigation
CSP Report-uri deprecated, replaced by report-to #512
Description
Adding a new CSP directive
Report-uri seems to be depricated: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri
Instead we want to use both, report-uri and report-to, to be future proof and backward compatible.
- Is the directive supported by any user agent? If so, which?
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to
- Chrome
- Edge
- Opera
-
What does it do?
Used to substitute report-uri. -
What are the valid values for the directive?
Content-Security-Policy: report-to ;
Activity
tmaier commentedon Oct 22, 2025
For additional context: The new
report-todirective requires theReporting-EndpointsHTTP header to define reporting endpoints (see W3C Reporting API spec and MDN docs).Rails has an open PR (#52367) for Reporting API support, likely targeting Rails 8.1.
Both
report-uri(deprecated) andreport-tocan coexist for backward compatibility during the transition period.Add support for W3C Reporting API
Add support for W3C Reporting API
Add support for W3C Reporting API
Add support for W3C Reporting API
Add support for W3C Reporting API
Kyfast/report to directive (#557)
denn-os commentedon Mar 30, 2026
This has been addressed in v7.2.0
#566