CSP creates two Reporting API endpoints for enforced and report-only violations when both modules are installed.
This was done to support older browsers that didn't include a 'disposition' attribute on reports, so it wasn't possible to determine which policy a report violated if they sent violations to the same url.
AFAIK:
- Chrome supports the report-to directive, which requires 'disposition' on each of the violations in the set it sends.
- Firefox still uses the report-uri directive, but does include 'disposition'.
- Review attributes included in violations by currently supported browsers
- Remove optional configuration when all browsers include 'disposition' in violation reports.
New installations will not have the additional report endpoints, but existing installations will not be changed.
Fixed
2.0
Code
Firefox ESR 115 is the oldest supported browser and it does send a "disposition" property on reports, so the additional reporting endpoints can be removed.
Automatically closed - issue fixed for 2 weeks with no activity.