See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Securi...
CSP: report-uri
Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.
See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Securi...
CSP: report-to
Warning: Though the report-to directive is intended to replace the deprecated report-uri directive, report-to isn't supported in most browsers yet. So for compatibility with current browsers while also adding forward compatibility when browsers get report-to support, you can specify both report-uri and report-to:
Content-Security-Policy: …; report-uri https://endpoint.com; report-to groupname
In browsers that support report-to, the report-uri directive will be ignored.
Active
2.0
Code
Adding the report-to directive and Report-To HTTP header would also require seckit module to support receiving reports in the new format.
Unless someone is really motivated to work on it, I'd say might as well postpone until Firefox and Safari support it - see https://bugzilla.mozilla.org/show_bug.cgi?id=1391243