Problem/Motivation

On the MDN page of the report-uri directive it is stated that report-uridirective is deprecated and report-to should be used instead

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cont...

For a long time the report-to directive wasn't supported by Firefox, however since Firefox 149 (Release date: 2026-03-24) it has been supported, and the support is now broad.

https://caniuse.com/mdn-http_headers_content-security-policy_report-to

Proposed resolution

Replace report-uri directive with report-to. However if it's deemed that we still need to support both directives it would be possible to provide both headers.

Comments

gaards created an issue.

gapple’s picture

gapple
he/they
Primary language English
commented

The Reporting API module provides the Reporting-Endpoints header and a plugin for CSP to output both report-to and report-uri directives: https://www.drupal.org/project/reporting

Currently it provides local handling for reports, but still needs work for #3017784: External Reporting Url so that it can take over the current capability of CSP module's other report handler plugins. CSP's plugins will likely be deprecated in favour of Reporting API taking over.