Report-To
ResponseActiveReport-To defines one or more reporting endpoints where the browser sends violation reports – CSP violations, NEL errors, deprecation warnings, and intervention reports. It is the successor to CSP's report-uri directive and the foundation of the browser Reporting API. Multiple report groups can be defined with different endpoints and TTLs.
Report-To: {"group": "<name>", "max_age": <seconds>, "endpoints": [{"url": "<url>"}]}
Description
Report-To configures reporting endpoints as a JSON object (or array of objects). Each endpoint group has a name, max_age, and list of endpoint URLs. CSP can reference a group with report-to <group-name> instead of report-uri. The Reporting API sends batched reports as POST requests with Content-Type: application/reports+json. Reports are queued and sent asynchronously to avoid impacting page performance.
Examples
Reporting endpoint
http
Report-To: {"group": "csp-endpoint", "max_age": 86400, "endpoints": [{"url": "https://reports.example.com/csp"}]}
Content-Security-Policy: default-src 'self'; report-to csp-endpointMultiple groups
http
Report-To: {"group": "default", "max_age": 86400, "endpoints": [{"url": "https://reports.example.com/"}]}, {"group": "csp", "max_age": 3600, "endpoints": [{"url": "https://reports.example.com/csp"}]}