Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to specify 2 endpoints for Reporting-Endpoints? #701

Open
SwiftExtender opened this issue Jan 15, 2025 · 2 comments
Open

How to specify 2 endpoints for Reporting-Endpoints? #701

SwiftExtender opened this issue Jan 15, 2025 · 2 comments
Labels
meta Tasks and questions outside the content of the standard

Comments

@SwiftExtender
Copy link

SwiftExtender commented Jan 15, 2025

I`ve tried:

(example CSP: script-src 'self'; report-to cspendpoint)

  1. Reporting-Endpoints: cspendpoint="https://csp.example.com/reporting-api/csp, https://csp.example.com/"
  2. Reporting-Endpoints: cspendpoint="https://csp.example.com/reporting-api/csp",cspendpoint="https://csp.example.com/"

Nothing is working.

How to specify 2 endpoints for same CSP violation?

@ciaramcmullin
Copy link
Collaborator

Could you use a single reporting header and have a unique names for each endpoint, and then reference both?

Reporting-Endpoints: cspendpoint1="https://csp.example.com/reporting-api/csp", cspendpoint2="https://csp.example.com/"

where the header uses both endpoints? Content-Security-Policy: default-src 'self'; report-to cspendpoint1, cspendpoint2

@dveditz dveditz added the meta Tasks and questions outside the content of the standard label Feb 12, 2025
@SwiftExtender
Copy link
Author

I,ve tried you variant but i got this:
Error: "The Content-Security-Policy directive name 'cspendpoint2' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names."

Headers:
content-security-policy: default-src 'self'; report-to cspendpoint1, cspendpoint2
reporting-endpoints: cspendpoint1="https://host1.com/reporting-api/endpoints", cspendpoint2="https://host2.com/csp/report"

I decided yo change name of second endpoint to 'cspendpoint' but its only changed error.

Error: Unrecognized Content-Security-Policy directive 'cspendpoint'.

Headers:
content-security-policy: default-src 'self'; report-to cspendpoint1, cspendpoint
reporting-endpoints: cspendpoint1="https://host1.com/reporting-api/endpoints", cspendpoint="https://host2.com/csp/report"

Image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
meta Tasks and questions outside the content of the standard
Projects
None yet
Development

No branches or pull requests

3 participants