Repository navigation
CSP Report-uri deprecated, replaced by report-to #512
Description
Activity
For additional context: The new
report-todirective requires theReporting-EndpointsHTTP header to define reporting endpoints (see W3C Reporting API spec and MDN docs).Rails has an open PR (#52367) for Reporting API support, likely targeting Rails 8.1.
Both
report-uri(deprecated) andreport-tocan coexist for backward compatibility during the transition period.- added 2 commits that reference this issue
on Oct 23, 2025 - added 3 commits that reference this issue
on Nov 19, 2025 - added a commit that references this issue
on Jan 8, 2026
Adding a new CSP directive
Report-uri seems to be depricated: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri
Instead we want to use both, report-uri and report-to, to be future proof and backward compatible.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-to
What does it do?
Used to substitute report-uri.
What are the valid values for the directive?
Content-Security-Policy: report-to ;