Safety
CSP report-uri vs Report-To for Violation Reports
February 14, 2023
CSP report-uri vs Report-To is how violation telemetry leaves the browser, not how CSP blocks scripts. report-uri is a CSP directive that POSTs reports to a URL. The Reporting API uses a Report-To or Reporting-Endpoints header plus a report-to group name inside CSP. New browsers prefer the Reporting API; report-uri still covers older ones. Ship both during a rollout if you must, but the real OPSEC is an HTTPS collector you monitor — an orphan report-uri is a dead letter. RoastMyOpsec reads CSP quality signals on the primary HTML response. It does not POST fake violations to your endpoint and it does not prove the collector is up.
The practical difference
report-uri is in-band in the CSP string. Report-To / Reporting-Endpoints is a separate header that names groups; CSP then says report-to groupname. The payload shape differs. Your collector must accept what you configured.
Report-Only without any reporting target is a silent flight recorder. Enforcing CSP without reports is a lock with no doorbell — still better than Report-Only forever, but you will not see what you broke.
How to choose based on the stack
Start with report-uri to an HTTPS path you control while Report-Only is on. Add Reporting-Endpoints when you are ready for the modern API. Do not send reports to HTTP. Do not point report-uri at a third-party URL you do not have a DPA for — reports can include blocked URIs and document URLs.
| Mechanism | Where it lives | Browser story | Takeaway |
|---|---|---|---|
| report-uri | Inside CSP | Older + still widely parsed | Fine as a first collector |
| Report-To header | Separate header, JSON groups | Being succeeded by Reporting-Endpoints | Check current MDN for your CDNs |
| Reporting-Endpoints + report-to | Header + CSP group | Current Reporting API | Prefer for new work |
| No target | Nowhere | Violations vanish | You cannot graduate Report-Only |
What the roast will not do
It will not flood your collector, will not parse whether the endpoint returns 204, and will not treat a missing report-uri as equal to missing CSP. Pair with report-only vs enforcing.
Common mistakes
The first mistake is report-uri on HTTP.
The second mistake is a Reporting-Endpoints group name that does not match CSP report-to.
The third mistake is a public collector that reflects reports into an XSS sink.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is report-uri enough without Report-To?
- It is enough to learn during rollout. Plan for the Reporting API as browsers move. The policy still has to enforce.
- Does RoastMyOpsec send CSP reports?
- No. Consented header read only. Confirm the collector with your own staging traffic.
- Can reports leak secrets?
- They can include document URLs and blocked resource URLs. Keep tokens out of URLs and lock down who can read the collector.